gmail
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseGmail API
Gmail API
Read, send, and manage emails via Google's Gmail REST API.
通过Google的Gmail REST API读取、发送和管理邮件。
When to Use
适用场景
Use this skill when you need to:
- Read and search emails
- Send emails or reply to threads
- Manage drafts
- Create and manage labels
- List and modify threads
- Get user profile information
当你需要以下操作时使用该技能:
- 读取和搜索邮件
- 发送邮件或回复线程
- 管理草稿
- 创建和管理标签
- 列出和修改邮件线程
- 获取用户个人资料信息
Prerequisites
前置条件
1. Create Google Cloud Project
1. 创建Google Cloud项目
- Go to https://console.cloud.google.com
- Create a new project or select existing
- Enable Gmail API: https://console.cloud.google.com/apis/library/gmail.googleapis.com
- 访问https://console.cloud.google.com
- 创建新项目或选择现有项目
- 启用Gmail API:https://console.cloud.google.com/apis/library/gmail.googleapis.com
2. Configure OAuth Consent Screen
2. 配置OAuth同意屏幕
- Go to https://console.cloud.google.com/apis/credentials/consent
- Select External → Create
- Fill required fields (app name, support email, developer email)
- Click Save and Continue through Scopes (skip adding scopes)
- In Audience section, click Add Users and add your Gmail address as test user
- Save and continue to finish
- 访问https://console.cloud.google.com/apis/credentials/consent
- 选择外部 → 创建
- 填写必填字段(应用名称、支持邮箱、开发者邮箱)
- 点击保存并继续跳过范围设置(无需添加范围)
- 在受众部分,点击添加用户并将你的Gmail地址添加为测试用户
- 保存并继续完成配置
3. Create OAuth Client ID
3. 创建OAuth客户端ID
- Go to https://console.cloud.google.com/apis/credentials
- Click Create Credentials → OAuth client ID
- Choose Web application (not Desktop)
- Add Authorized redirect URI:
https://developers.google.com/oauthplayground - Click Create and note the Client ID and Client Secret
- 访问https://console.cloud.google.com/apis/credentials
- 点击创建凭据 → OAuth客户端ID
- 选择Web应用(不要选桌面端)
- 添加授权重定向URI:
https://developers.google.com/oauthplayground - 点击创建并记录客户端ID和客户端密钥
4. Get Refresh Token (OAuth Playground)
4. 获取刷新令牌(OAuth Playground)
- Go to https://developers.google.com/oauthplayground/
- Click Settings (gear icon ⚙️) → Check Use your own OAuth credentials
- Enter your Client ID and Client Secret
- In the left panel, enter scope:
https://www.googleapis.com/auth/gmail.modify - Click Authorize APIs → Sign in with your test user account
- Click Exchange authorization code for tokens
- Copy the Refresh token
- 访问https://developers.google.com/oauthplayground/
- 点击设置(齿轮图标⚙️)→ 勾选使用你自己的OAuth凭据
- 输入你的客户端ID和客户端密钥
- 在左侧面板中,输入范围:
https://www.googleapis.com/auth/gmail.modify - 点击授权API → 使用测试用户账号登录
- 点击交换授权码以获取令牌
- 复制刷新令牌
5. Set Environment Variables
5. 设置环境变量
bash
export GMAIL_CLIENT_ID="your-client-id"
export GMAIL_CLIENT_SECRET="your-client-secret"
export GMAIL_REFRESH_TOKEN="your-refresh-token"bash
export GMAIL_CLIENT_ID="your-client-id"
export GMAIL_CLIENT_SECRET="your-client-secret"
export GMAIL_REFRESH_TOKEN="your-refresh-token"Get Access Token
获取访问令牌
Access tokens expire after 1 hour. Use refresh token to get a new one and save to :
/tmpbash
bash -c 'curl -s -X POST "https://oauth2.googleapis.com/token" -d "client_id=$GMAIL_CLIENT_ID" -d "client_secret=$GMAIL_CLIENT_SECRET" -d "refresh_token=$GMAIL_REFRESH_TOKEN" -d "grant_type=refresh_token"' | jq -r '.access_token' > /tmp/gmail_token.txt访问令牌1小时后过期。使用刷新令牌获取新令牌并保存到:
/tmpbash
bash -c 'curl -s -X POST "https://oauth2.googleapis.com/token" -d "client_id=$GMAIL_CLIENT_ID" -d "client_secret=$GMAIL_CLIENT_SECRET" -d "refresh_token=$GMAIL_REFRESH_TOKEN" -d "grant_type=refresh_token"' | jq -r '.access_token' > /tmp/gmail_token.txtVerify token was obtained
验证令牌是否获取成功
head -c 20 /tmp/gmail_token.txt && echo "..."
> **Important:** When using `$VAR` in a command that pipes to another command, wrap the command containing `$VAR` in `bash -c '...'`. Due to a Claude Code bug, environment variables are silently cleared when pipes are used directly.
> **Placeholders:** Values in `{curly-braces}` like `{message-id}` are placeholders. Replace them with actual values when executing.
---head -c 20 /tmp/gmail_token.txt && echo "..."
> **重要提示:** 当在包含管道的命令中使用`$VAR`时,请将包含`$VAR`的命令用`bash -c '...'`包裹。由于Claude Code的一个bug,直接使用管道时环境变量会被静默清除。
> **占位符:** 像`{message-id}`这样用`{大括号}`包裹的值是占位符,执行时请替换为实际值。
---User Profile
用户个人资料
Get Profile
获取个人资料
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/profile" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/profile" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Messages
邮件消息
List Messages
列出邮件消息
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=10" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=10" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'List Messages with Query
按查询条件列出邮件消息
Search using Gmail query syntax:
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages?q=is:unread&maxResults=10" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Common queries:
- - Unread messages
is:unread - - From specific sender
from:example@gmail.com - - Subject contains "hello"
subject:hello - - After date
after:2024/01/01 - - Has attachments
has:attachment - - In inbox
label:INBOX
使用Gmail查询语法搜索:
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages?q=is:unread&maxResults=10" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'常用查询条件:
- - 未读邮件
is:unread - - 来自特定发件人
from:example@gmail.com - - 主题包含"hello"
subject:hello - - 指定日期之后的邮件
after:2024/01/01 - - 包含附件的邮件
has:attachment - - 收件箱中的邮件
label:INBOX
Get Message
获取单条邮件消息
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Get Message (Metadata Only)
获取单条邮件消息(仅元数据)
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}?format=metadata&metadataHeaders=From&metadataHeaders=Subject&metadataHeaders=Date" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}?format=metadata&metadataHeaders=From&metadataHeaders=Subject&metadataHeaders=Date" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Send Email
发送邮件
bash
undefinedbash
undefinedCreate RFC 2822 message and base64url encode
创建符合RFC 2822标准的消息并进行base64url编码
RAW_MESSAGE=$(echo -e "To: {recipient-email}\r\nSubject: {subject}\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n{body-text}" | base64 | tr '+/' '-_' | tr -d '=')
Write to `/tmp/gmail_request.json`:
```json
{
"raw": "$RAW_MESSAGE"
}Then run:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/messages/send" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'RAW_MESSAGE=$(echo -e "To: {recipient-email}\r\nSubject: {subject}\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n{body-text}" | base64 | tr '+/' '-_' | tr -d '=')
写入`/tmp/gmail_request.json`:
```json
{
"raw": "$RAW_MESSAGE"
}然后执行:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/messages/send" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'Reply to Thread
回复邮件线程
bash
undefinedbash
undefinedInclude In-Reply-To and References headers for proper threading
包含In-Reply-To和References头以确保正确的线程关联
RAW_MESSAGE=$(echo -e "To: {recipient-email}\r\nSubject: Re: {original-subject}\r\nIn-Reply-To: <{original-message-id}>\r\nReferences: <{original-message-id}>\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n{reply-text}" | base64 | tr '+/' '-_' | tr -d '=')
Write to `/tmp/gmail_request.json`:
```json
{
"raw": "$RAW_MESSAGE",
"threadId": "{thread-id}"
}Then run:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/messages/send" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'RAW_MESSAGE=$(echo -e "To: {recipient-email}\r\nSubject: Re: {original-subject}\r\nIn-Reply-To: <{original-message-id}>\r\nReferences: <{original-message-id}>\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n{reply-text}" | base64 | tr '+/' '-_' | tr -d '=')
写入`/tmp/gmail_request.json`:
```json
{
"raw": "$RAW_MESSAGE",
"threadId": "{thread-id}"
}然后执行:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/messages/send" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'Modify Message Labels
修改邮件消息标签
Write to :
/tmp/gmail_request.jsonjson
{
"addLabelIds": ["STARRED"],
"removeLabelIds": ["UNREAD"]
}Then run:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}/modify" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'写入:
/tmp/gmail_request.jsonjson
{
"addLabelIds": ["STARRED"],
"removeLabelIds": ["UNREAD"]
}然后执行:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}/modify" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'Trash Message
将邮件移至垃圾箱
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}/trash" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}/trash" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Delete Message Permanently
永久删除邮件
bash
bash -c 'curl -s -X DELETE "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s -X DELETE "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Threads
邮件线程
List Threads
列出邮件线程
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/threads?maxResults=10" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/threads?maxResults=10" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Get Thread
获取邮件线程
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/threads/{thread-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/threads/{thread-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Trash Thread
将邮件线程移至垃圾箱
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/threads/{thread-id}/trash" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/threads/{thread-id}/trash" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Labels
标签
List Labels
列出标签
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/labels" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"' | jq '.labels[] | {id, name, type}'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/labels" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"' | jq '.labels[] | {id, name, type}'Create Label
创建标签
Write to :
/tmp/gmail_request.jsonjson
{
"name": "{label-name}",
"labelListVisibility": "labelShow",
"messageListVisibility": "show"
}Then run:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/labels" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'写入:
/tmp/gmail_request.jsonjson
{
"name": "{label-name}",
"labelListVisibility": "labelShow",
"messageListVisibility": "show"
}然后执行:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/labels" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'Delete Label
删除标签
bash
bash -c 'curl -s -X DELETE "https://gmail.googleapis.com/gmail/v1/users/me/labels/{label-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s -X DELETE "https://gmail.googleapis.com/gmail/v1/users/me/labels/{label-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Drafts
草稿
List Drafts
列出草稿
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/drafts" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/drafts" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Create Draft
创建草稿
bash
RAW_MESSAGE=$(echo -e "To: {recipient-email}\r\nSubject: {subject}\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n{body-text}" | base64 | tr '+/' '-_' | tr -d '=')Write to :
/tmp/gmail_request.jsonjson
{
"message": {
"raw": "$RAW_MESSAGE"
}
}Then run:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/drafts" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'bash
RAW_MESSAGE=$(echo -e "To: {recipient-email}\r\nSubject: {subject}\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n{body-text}" | base64 | tr '+/' '-_' | tr -d '=')写入:
/tmp/gmail_request.jsonjson
{
"message": {
"raw": "$RAW_MESSAGE"
}
}然后执行:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/drafts" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'Send Draft
发送草稿
Write to :
/tmp/gmail_request.jsonjson
{
"id": "{draft-id}"
}Then run:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/drafts/send" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'写入:
/tmp/gmail_request.jsonjson
{
"id": "{draft-id}"
}然后执行:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/drafts/send" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'Delete Draft
删除草稿
bash
bash -c 'curl -s -X DELETE "https://gmail.googleapis.com/gmail/v1/users/me/drafts/{draft-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s -X DELETE "https://gmail.googleapis.com/gmail/v1/users/me/drafts/{draft-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Attachments
附件
Get Attachment
获取附件
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}/attachments/{attachment-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"' | jq -r '.data' | base64 -d > attachment.binbash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}/attachments/{attachment-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"' | jq -r '.data' | base64 -d > attachment.binSettings
设置
Get Vacation Settings
获取休假设置
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/settings/vacation" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/settings/vacation" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Update Vacation Settings
更新休假设置
Write to :
/tmp/gmail_request.jsonjson
{
"enableAutoReply": true,
"responseSubject": "Out of Office",
"responseBodyPlainText": "I am currently out of office.",
"restrictToContacts": false,
"restrictToDomain": false
}Then run:
bash
bash -c 'curl -s -X PUT "https://gmail.googleapis.com/gmail/v1/users/me/settings/vacation" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'写入:
/tmp/gmail_request.jsonjson
{
"enableAutoReply": true,
"responseSubject": "Out of Office",
"responseBodyPlainText": "I am currently out of office.",
"restrictToContacts": false,
"restrictToDomain": false
}然后执行:
bash
bash -c 'curl -s -X PUT "https://gmail.googleapis.com/gmail/v1/users/me/settings/vacation" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'List Filters
列出过滤器
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/settings/filters" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/settings/filters" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"'Create Filter
创建过滤器
Write to :
/tmp/gmail_request.jsonjson
{
"criteria": {
"from": "{filter-email}"
},
"action": {
"addLabelIds": ["TRASH"],
"removeLabelIds": ["INBOX"]
}
}Then run:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/settings/filters" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'写入:
/tmp/gmail_request.jsonjson
{
"criteria": {
"from": "{filter-email}"
},
"action": {
"addLabelIds": ["TRASH"],
"removeLabelIds": ["INBOX"]
}
}然后执行:
bash
bash -c 'curl -s -X POST "https://gmail.googleapis.com/gmail/v1/users/me/settings/filters" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)" --header "Content-Type: application/json" -d @/tmp/gmail_request.json'Common Scopes
常用范围
| Scope | Permission |
|---|---|
| Read-only access |
| Send emails only |
| Create drafts and send |
| Read, send, delete, manage |
| Manage labels only |
| Manage basic settings |
| Manage sensitive settings |
Use full URL:
https://www.googleapis.com/auth/gmail.modify| 范围 | 权限 |
|---|---|
| 只读访问 |
| 仅发送邮件 |
| 创建草稿并发送 |
| 读取、发送、删除、管理 |
| 仅管理标签 |
| 管理基本设置 |
| 管理敏感设置 |
使用完整URL:
https://www.googleapis.com/auth/gmail.modifyDecode Message Body
解码邮件正文
Gmail returns message body as base64url encoded. To decode:
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"' | jq -r '.payload.body.data // .payload.parts[0].body.data' | tr '_-' '/+' | base64 -dGmail返回的邮件正文是base64url编码的。解码方式:
bash
bash -c 'curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages/{message-id}" --header "Authorization: Bearer $(cat /tmp/gmail_token.txt)"' | jq -r '.payload.body.data // .payload.parts[0].body.data' | tr '_-' '/+' | base64 -dGuidelines
注意事项
- Token Refresh: Access tokens expire in 1 hour; always refresh before API calls
- Rate Limits: Gmail API has quota limits; implement exponential backoff
- Batch Requests: Use batch endpoints for multiple operations
- Message Format: Messages must be RFC 2822 compliant and base64url encoded
- Scopes: Request minimum required scopes for your use case
- 令牌刷新:访问令牌1小时后过期;API调用前请务必刷新令牌
- 速率限制:Gmail API有配额限制;请实现指数退避机制
- 批量请求:使用批量端点执行多个操作
- 消息格式:消息必须符合RFC 2822标准并进行base64url编码
- 范围选择:根据使用场景请求最小必要的权限范围