The Google OAuth 2.0 endpoint supports server-to-server interactions such as those between a web application and Google Cloud Storage.
A service account is used when you want to access your own data and not data owned by other users. In this instance there is no reason to use OAuth2 and prompt a user to give you access to there information, its your information you already have access.
For this scenario you need a service account, which is an account that belongs to your application instead of to an individual end user. For example, if you use the Google Prediction API to act on behalf of your application without accessing any user data, your application uses its service-account credentials to prove its own identity, and no end user is involved.
A service account's credentials include a generated email address that is unique, a client ID, and at least one public/private key pair. You obtain these credentials in the Google Developers Console, or if your application uses Google App Engine, a service account is set up automatically. You use the client ID and one private key to create a signed JWT and construct an access-token request in the appropriate format.
