Credentials take an afternoon. Going live depends entirely on scopes: send-only needs a standard review, anything that reads mail triggers Google's strictest review plus a paid yearly security assessment.
No credentials needed here. The agent never needs your client secret; anything that looks like one is blocked.