Have been working through the docs but can't reconcile some things I clearly don't understand. Javascript on client side.

gapi.client.init({
        apiKey: API_KEY,
        clientId: CLIENT_ID,
        discoveryDocs: DISCOVERY_DOCS,
        scope: SCOPES
      })

used as per the docs

scopes have been set to either https://www.googleapis.com/auth/drive or https://drive.google.com/drive/folders/somestringoflettersannumbersanddashes-?usp=sharing

But am trying to avoid needing to log in, especially as the latter scope has full editing permissions enabled and does seem to be able to access the folder.

gapi.client.drive.files.list({q:string,fields:string}) is able to generate a list, but gapi.client.drive.files.create and delete({fileId:someid}) return a 401 error - login required.

I don't know where I'm going wrong and the docs make it painfully UNclear what the requirements are, etc, why accessing the folder list seems to work while doing anything to it seems blocked off.

Or maybe I'm missing a parameter, who knows, it's a mystery. Can anybody tell me if I am doing something wrong with the calls or if, in the end, a user needs to be logged in to their google account to make changes.