GSuite oauth token getting unauthenticated for calling mail API

[brijendra-lsq]

We have build an OAuth app which takes basic scope and gmail readonly scope https://www.googleapis.com/auth/gmail.readonly. Application subscribes the pub/sub and on receiving hit from Gmail, we call API to fetch list of mails after particular historyId (https://gmail.googleapis.com/gmail/v1/users/me/history).

The above setup is working for most of the GSuite account. For one of the GSuite account, the users are able to connect their account via OAuth and subscribe to the pub/sub via API (https://gmail.googleapis.com/gmail/users/me/watch) and receiving hits on the webhook URL as well. But while calling above mail API(just after connecting the account, so the access token is valid only)to fetch list of mails, Gmail is returning 401 error with message Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.

Can someone explain what can be the possible reason for above API fails.

The GSuite account which is facing issue is of Google Workspace for Education editions.

I checked the Gsuite settings and verified that the OAuth app is marked as Trusted for the Organizational unit in which users are trying to connect. Also, for the same organizational unit, below 18 user age option is not selected (It is default).