Google.GoogleApiException was unhandled by user code

Question

I am having trouble connecting to the Google Apps Reseller API (for .NET) using the service credentials model.

Any ideas of where I am going wrong?

Steps:

1. Created service application in google developer console
2. Enabled APIs (Admin SDK; BigQuery API; Debuglet Controller API; Enterprise; License Manager API; Google Apps Reseller API ; Google Cloud Logging API ; Google Cloud SQL; Google Cloud Storage; Google Cloud Storage JSON API; Site Verification API)
3. Created API permissions on Google apps domain (reseller domain)

Source:

=====================

using Google.Apis.Auth.OAuth2;
using Google.Apis.Reseller.v1;
using Google.Apis.Reseller.v1.Data;
using Google.Apis.Services;
using Google.Apis.Util.Store;
using System.IO;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Security.Cryptography.X509Certificates;
using Google.Apis.Auth.OAuth2;
using Google.Apis.Services;

namespace GoogleApiWeb
{
    public partial class _Default : Page
    {

        static string ApplicationName = "Testing API";
        protected void Page_Load(object sender, EventArgs e)
        {

            String serviceAccountEmail = "...removed...@developer.gserviceaccount.com";

            var certificate = new X509Certificate2(@"C:\\Dev\\GoogleApiWeb\\GoogleApiWeb\\TestingResellerAPI-6555.p12", "notasecret", X509KeyStorageFlags.Exportable);

            ServiceAccountCredential credential = new ServiceAccountCredential(
               new ServiceAccountCredential.Initializer(serviceAccountEmail)
               {
                   Scopes = new[] { ResellerService.Scope.AppsOrder }
               }.FromCertificate(certificate));

            // Create Google Apps Reseller API service.
            var service = new ResellerService(new BaseClientService.Initializer()
            {
                HttpClientInitializer = credential,
                ApplicationName = ApplicationName,
            });

            // Define parameters of request.
            SubscriptionsResource.ListRequest request = service.Subscriptions.List();
            request.MaxResults = 10;

            // List subscriptions.
            IList<Subscription> subscriptions = request.Execute().SubscriptionsValue;
            Response.Write("<p>Subscriptions:</p>");
            if (subscriptions != null && subscriptions.Count > 0)
            {
                foreach (var subscription in subscriptions)
                {
                    {
                        Response.Write(subscription.CustomerId.ToString());
                        Response.Write(": ");
                        Response.Write(subscription.SkuId.ToString());
                        Response.Write(" ");
                        Response.Write(subscription.Plan.PlanName.ToString());
                        Response.Write('\n');
                    }
                }
            }
            else
            {
                Response.Write("No subscriptions found.");
            }

        }
    }
}

Application error:

Google.GoogleApiException was unhandled by user code
  HResult=-2146233088
  Message=Google.Apis.Requests.RequestError
Forbidden [403]
Errors [
    Message[Forbidden] Location[ - ] Reason[forbidden] Domain[global]
]

  Source=Google.Apis
  ServiceName=reseller
  StackTrace:
       at Google.Apis.Requests.ClientServiceRequest`1.Execute() in c:\code\google.com\google-api-dotnet-client\default\Tools\Google.Apis.Release\bin\Debug\test\default\Src\GoogleApis\Apis\Requests\ClientServiceRequest.cs:line 96
       at GoogleApiWeb._Default.Page_Load(Object sender, EventArgs e) in c:\Dev\GoogleApiWeb\GoogleApiWeb\Default.aspx.cs:line 53
       at System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e)
       at System.Web.UI.Control.OnLoad(EventArgs e)
       at System.Web.UI.Control.LoadRecursive()
       at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
  InnerException: