Request only the calendar access the feature needs
Map read, free/busy, and write features to the documented Google scopes, configure the consent screen and redirect URI, and complete the verification required for production use. Keep tokens server-side and account-scoped.