I see what you're saying. My motivation for linking to a new endpoint on SendMail, as opposed to directly to the Google Auth link from the extension was two fold. Firstly, it seemed to open up the extension to configuration as you mentioned in the first comment. Our Client ID in secrets.json can now live only on the server side, rather than having to construct the appropriate gauth URL client side (as you mentioned that would be a pain). As we discussed offline, the best solution is to redirect to the google URL directly. Implementing now.

As far as putting a "extensionAuth" flag on the callback (which can be done even if we keep the gauth URL construction server side), in order to inject/not inject the user info on the page, I agree. I did want to do this, as a way to more elegantly inform the extension to act or not (as you noted, as of now it will always grab the key and alert the user, even if via the regular site auth flow. I'm adding a TODO.