There seem to be 3 methods as listed below. The third is superior for what i'm after. How does it work? Where is this process documented?
using the Google Embed API like shown in the "Basic Dashboard" example Embed API documentation. It uses a one click login method and requires you to know and enter user credentials for every session. This is what I use right now.
The Google Embed API documentation describes "Server-side Authorization". It uses a key in a JSON file made via the Google Developer Console. It can be authorized indefinately to access any kind of datasource enabled in the Google Developer Console.
There seems to be a third method. It is used for example in Google Analytics for WordPress. It uses a one time approval which leads to a key string as shown in this video by which the plugin can be authorized indefinately. The Google Developer Console is not accessed and no JSON file is uploaded anywhere. This offers the best UX.