google.auth.exceptions.RefreshError using delegated credentials

Hi,

I’m trying to use the Google API client to retrieve email for a user using a service account. I’ve created the service account credentials with a role of Project Owner, and with domain-wide delegation enabled. However, when I try to connect as a particular user I get:

Traceback (most recent call last):
  File "gmail.py", line 43, in <module>
    messages = ListMessages(service, '[e-mail]')
  File "gmail.py", line 22, in ListMessages
    response = service.users().messages().list(userId=user).execute()
  File "/home/ubuntu/.local/lib/python2.7/site-packages/googleapiclient/_helpers.py", line 130, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "/home/ubuntu/.local/lib/python2.7/site-packages/googleapiclient/http.py", line 846, in execute
    method=str(self.method), body=self.body, headers=self.headers)
  File "/home/ubuntu/.local/lib/python2.7/site-packages/googleapiclient/http.py", line 164, in _retry_request
    resp, content = http.request(uri, method, *args, **kwargs)
  File "/home/ubuntu/.local/lib/python2.7/site-packages/google_auth_httplib2.py", line 187, in request
    self._request, method, uri, request_headers)
  File "/home/ubuntu/.local/lib/python2.7/site-packages/google/auth/credentials.py", line 122, in before_request
    self.refresh(request)
  File "/home/ubuntu/.local/lib/python2.7/site-packages/google/oauth2/service_account.py", line 322, in refresh
    request, self._token_uri, assertion)
  File "/home/ubuntu/.local/lib/python2.7/site-packages/google/oauth2/_client.py", line 145, in jwt_grant
    response_data = _token_endpoint_request(request, token_uri, body)
  File "/home/ubuntu/.local/lib/python2.7/site-packages/google/oauth2/_client.py", line 111, in _token_endpoint_request
    _handle_error_response(response_body)
  File "/home/ubuntu/.local/lib/python2.7/site-packages/google/oauth2/_client.py", line 61, in _handle_error_response
    error_details, response_body)
google.auth.exceptions.RefreshError: ('unauthorized_client: Client is unauthorized to retrieve access tokens using this method.', u'{\n  "error": "unauthorized_client",\n  "error_description": "Client is unauthorized to retrieve access tokens using this method."\n}')

In terms of software versions I have:

google-api-python-client (1.7.7) google-auth (1.6.2) google-auth-httplib2 (0.0.3)

Here’s the code I’m using:

from google.oauth2 import service_account
import googleapiclient.discovery

SCOPES = ['https://www.googleapis.com/auth/gmail.modify']
SERVICE_ACCOUNT_FILE = 'service-account.json'


def ListMessages(service, user):

        response = service.users().messages().list(userId=user).execute()
        messages = response['messages']

        while 'nextPageToken' in response:
                page_token = response['nextPageToken']
                response = service.users().messages().list(userId=user, pageToken=page_token).execute()
                messages.extend(response['messages'])

        return messages


if __name__ == "__main__":
        credentials = service_account.Credentials.from_service_account_file(SERVICE_ACCOUNT_FILE, scopes=SCOPES)
        delegated_credentials = credentials.with_subject('[e-mail]')
        service = googleapiclient.discovery.build('gmail', 'v1', credentials=delegated_credentials)


        messages = ListMessages(service, '[e-mail]')

Any help appreciated.

Thanks, Tom

[mthaddon]

I’ve discovered that credentials.token is empty and credentials.valid is False. Looks like there are additional steps needed to authorize the credentials? I’m following https://developers.google.com/api-client-library/python/auth/service-accounts and https://developers.google.com/gmail/api/quickstart/python for the GMail API portion but don’t see any steps to authorize beyond what I’m doing above.

[mthaddon]

I was able to get this working, thanks. The fix was to delete any non-service-account credentials for this account (I’d set up some oauth credentials as well). Is there somewhere I could propose a doc update to clarify this?