embrace, extend, snuff? :)
if anyone wants to give it a try, there is enough Go code -- packages and samples -- to make it less painful.
here's a sample [0] OAuth2-based web server ("resource provider") that works with Google ("identity provider"). it runs on Plan 9, but each instance will need its own client ID and client secret from Developer Console. the code for installed app should be similar [1] with auth tokens coming through a redirect to localhost rather than accessing a web address. the access token can then be forward to imap4 or smtp [2]