At least one client secrets (Installed or Web) should be set

I’m trying to create a token using a JSON service account private key file, and no matter what I do the GoogleWebAuthorizationBroker keeps giving the following error.

At least one client secrets (Installed or Web) should be set

Why is the broker asking for a client secret? Isn’t that the whole purpose of a service account with domain wide delegated permissions?

using System;
using System.IO;
using System.Threading;
using Google.Apis.Admin.Directory.directory_v1;
using Google.Apis.Auth.OAuth2;
using Google.Apis.Util.Store;


class Program
    {
        // If modifying these scopes, delete your previously saved credentials
        // at ~/.credentials/admin-directory_v1-dotnet-quickstart.json
        static string[] Scopes = { DirectoryService.Scope.AdminDirectoryDeviceChromeos };
        static string ApplicationName = "TokenStore";

        static void Main(string[] args)
        {
            UserCredential credential;

            using (var stream =
                new FileStream(Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "client_secret.json"), FileMode.Open, FileAccess.Read))
            {
                string credPath = AppDomain.CurrentDomain.BaseDirectory;
                credPath = Path.Combine(credPath, "\\token.json");

                credential = GoogleWebAuthorizationBroker.AuthorizeAsync(
                    GoogleClientSecrets.Load(stream).Secrets,
                    Scopes,
                    "user",
                    CancellationToken.None,
                    new FileDataStore(credPath, true)).Result;
                Console.WriteLine("Credential file saved to: " + credPath);
            }

        }
    }

[chrisdunelm]

Oh right, I see. The code is mixing up service credentials and oauth credentials. I thought you were wanting to use oauth, but if you’ve downloaded a service credential then don’t use GoogleWebAuthorizationBroker, that’s for oauth. Create a credential like this: var cred = GoogleCredentials.FromFile(<path to file>).CreateScoped(<scopes you require>);.

[chrisdunelm]

It’s in the nuget package Google.Apis.Auth; and the fully-qualified name is Google.Apis.Auth.OAuth2.GoogleCredential. Here’s the source-code: https://github.com/googleapis/google-api-dotnet-client/blob/aadabafd8ec8c3118e5f71e388ccb3718ee2e002/Src/Support/Google.Apis.Auth/OAuth2/GoogleCredential.cs