title: How to avoid script authorization prompt when G-Suite user is accessing G-Suite trusted app script?
body: <p>I wrote an app script which provides a web UI for data entry into a team calendar.  I published it using G-Suite super admin account and added it as Trusted App under Security/API Permissions.  "Trust domain owned apps" is checked under "Internal App Settings".</p>
  
  <p>When a G-Suite user in our organization tries to access the app, he sees</p>
  
  <p><strong>"The developer of ShiftSchedulingApp, admin@_our_organization_.org, needs your permission to access your data on Google."</strong></p>
  
  <p>Those brave enough to click "Review Permissions" are taken to the next message:</p>
  
  <p><strong>"ShiftSchedulingApp wants to access your Google Account.  See, edit, share, and permanently delete all the calendars you can access using Google Calendar"</strong></p>
  
  <p>Of course nobody wants to risk losing all the calendars on their Google Account and this is where it ends.</p>
  
  <p>How do I get rid of this misleading message?  It's not Google account, it's their organization account on G-Suite.  It's not all their calendars, it's the shared team calendar only.  It's adding data, not permanently deleting calendars.  It's published by their administrator in their G-Suite, not an unknown 3rd party. </p>
  
  <p>I spent days trying to make this message go away but no luck.  App must be executed as an accessing user and not as publishing user because their user ID determines what shifts they can fill on a calendar.</p>
  
  <p>I'd appreciate any hints pointing me the right direction.</p>
  
  <hr>
  
  <p>I experimented with variations of the two-app approach as suggested.</p>
  
  <p>The app which provides the UI needs to read the calendar to display available shifts - so I can't get away from the user authorization prompt.  </p>
  
  <p>Another variation I tried was having one app do everything and run as me, and another do nothing but return Session.getActiveUser().  I tried calling the 2nd one from the 1st one on the client side via XMLHttpRequest.  It would be ideal for my needs - but I hit CORS error as apps URL is script.google.com but it actually gets redirected to script.googleusercontent.com.  There doesn't seem to be a way to set CORS in Google App Script.</p>