Unable to list resources

This might or might not be viewed as a feature/lack of feature for gsutil.
If this is missplaced please accept my apology.

I'm developing a statistics applications, like App Annie. My users give
me offline control to devstorage.readonly.

Using my apps client_id and client_secret I can use the refresh_token I
got from when the user, pass this to gsutil and download the files I
need.

Except that I can't find a way to list which files I need. How can I
list which files (or rather buckets) I've access to?

As I understand it, all these buckets are owned by google but are
accessable to the user. Hence the user is not the owner of the bucket.

The bucket name is pubsite_prod_rev_0956830154XXXXXXX where the last
number is the dev_acc of the user (that number I haven't figured out a
way to access).

Looking at how other people have solved this:
- App Annie asks for your username and password so that they can
login to your account. This isn't really good for the user at all.
You should never need to part with your password, and what about
2FA?
- Andlytics asks for a uberToken, hence full account access. This is
also not good. If I only need devstorage.readonly, why should I
ask for full account access just to know where the files I want to
download are located?

How can I solve this problem in a userfriendly and secure way?