CODEWITHSUNDEEP
oauth-2.0google-admin-sdk
luissquall
luissquall

Reputation: 1880

Support for Service Accounts OAuth2 scenario

Does Directory API support authentication with OAUth2 Service Accounts flow?

I tested the serviceAccount.php google-php-api-client example using the scopes https://www.googleapis.com/auth/admin.directory.group and https://www.googleapis.com/auth/admin.directory.user and it didn't work.

Upvotes: 4

Views: 881

Answers (2)

luissquall
luissquall

Reputation: 1880

Short answer: Yes. @emilylam question comments hint the error.

Upvotes: 0

Jay Lee
Jay Lee

Reputation: 13528

You need to authorize the service account client ID to access the given API scopes in the Google Apps Control Panel. See the step as described in the Drive API docs, just sub in your Admin SDK scopes.

Note that IMHO, there's very little advantage to using a Service Account with Directory/Reporting APIs as you still need to impersonate a user who has super admin (or proper delegated admin) roles in order to perform and API calls. To me it makes just as much sense to just get a 3-legged OAuth 2.0 refresh token which supports offline from the admin. 3-legged can be done entirely programmatically where-as Service Accounts require the manual step above.

Upvotes: 1

Related Questions