CODEWITHSUNDEEP
pythongoogle-sheets
Etiksha Jain
Etiksha Jain

Reputation: 31

Google Sheet API access with Application Default credentials using scopes giving Insufficient Scopes error while running on GCP VM

I am trying to access Google Sheet (read write mode) from Python (runs in GKE). I have tried both outh2client as well as google-auth approach but it gives the same error every time:

googleapiclient.errors.HttpError: <HttpError 403 when requesting https://sheets.googleapis.com/v4/spreadsheets/1kvHv1OBCzr9GnFxRu9RTJC7jjQjc9M4rAiDnhyak2Sg/values/vm_metrics%21A10?alt=json returned "Request had insufficient authentication scopes.". Details: "[{'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'ACCESS_TOKEN_SCOPE_INSUFFICIENT', 'domain': 'googleapis.com', 'metadata': {'method': 'google.apps.sheets.v4.SpreadsheetsService.GetValues', 'service': 'sheets.googleapis.com'}}]">

This is my code using outh2client:

from googleapiclient.discovery import build
from oauth2client import client

creds=client.GoogleCredentials.get_application_default().create_scoped(
          ['https://www.googleapis.com/auth/spreadsheets'])
service = build('sheets', 'v4', credentials=creds)
sheet = service.spreadsheets()
sheet.values().get(spreadsheetId='whatev', range='Sheet1!A:C').execute()

This is my code using google-auth:

import google.auth

SCOPES = ['https://www.googleapis.com/auth/spreadsheets']

creds, project=google.auth.default(scopes=SCOPES)
service = build('sheets', 'v4', credentials=creds)
sheet = service.spreadsheets()
sheet.values().get(spreadsheetId='XXXXXXXXXX', range='Sheet1!A:C').execute()

Upvotes: 3

Views: 1541

Answers (1)

Daniel King
Daniel King

Reputation: 510

AFAICT, this is the same question as Google Sheet API access with Application Default credentials. The solution (from that SO post) is

from googleapiclient.discovery import build
from oauth2client import client

creds = client.GoogleCredentials.get_application_default().create_scoped(
    ['https://www.googleapis.com/auth/spreadsheets.readonly']
)
response = service.spreadsheets().values().get(
    spreadsheetId='XXXXXXXXXX',
    range='Sheet1!A:C'
).execute()
rows = response['values']

However, this will not work with the usual application default credentials you get from gcloud auth application-default login. You'll get this error:

Traceback (most recent call last):
  File "<ipython-input-2-2a9ba7e9e38f>", line 8, in <module>
    sheet.values().get(spreadsheetId='1BxiMVs0XRA5nFMdKvBdBZjgmUUqptlbs74OgvE2upms', range='Class Data!A2:E''....').execute()
  File "/Users/dking/miniconda3/lib/python3.7/site-packages/googleapiclient/_helpers.py", line 130, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "/Users/dking/miniconda3/lib/python3.7/site-packages/googleapiclient/http.py", line 855, in execute
    raise HttpError(resp, content, uri=self.uri)
HttpError: <HttpError 403 when requesting https://sheets.googleapis.com/v4/spreadsheets/1BxiMVs0XRA5nFMdKvBdBZjgmUUqptlbs74OgvE2upms/values/Class%20Data%21A2%3AE....?alt=json returned "Request had insufficient authentication scopes.">

The fix is actually quite simple! h/t to James for pointing this out in a comment. You must expand the OAuth scopes for your application default credentials to include the Google Sheets API and you must also set a quota project which Google Sheets uses for rate limiting. At time of writing there is no documented cost to using the Sheets API, but there is a 300 requests per project per minute limit.

gcloud auth application-default login \
            --scopes=openid,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/spreadsheets

gcloud auth application-default set-quota-project YOUR_GCP_PROJECT

Upvotes: 9

Related Questions