This describes how to authenticate with Google Datastore using Goa accessing user resources, as described in Oauth2 for Apps Script in a few lines of code (which you should read first for background).
The library, cGoa, is available under this project key.
Up till now, the OAuth environment has been mainly focused on apps you write to access your self, or your resources. The other use of OAuth is to get consent from users to access their resources. In this case, each individual user needs to give consent for the scopes your app app is requesting.
Goa does this by expecting to store user refresh information in the specific users property store for this script. So if you have a web app published like this
you need to add one line to your doGet() dialog. As normal, once authorized for a specific user, refreshing will be automatic by defaultt (unless revoked)
You'll need to create an App. The dashboard/developers console can be found here. Your one time setup would look something like this. Note that you can use the same credentials and package name as used in Google Datastore service for Goa examples (which was for apps being run as you) as the template for credentials to be used for apps being run as the user.
Learning Apps Script, (and transitioning from VBA) are covered comprehensively in my my book, Going Gas - from VBA to Apps script, All formats are available from O'Reilly, Amazon and all good bookshops. You can also read a preview on O'Reilly