CODEWITHSUNDEEP
google-apigoogle-calendar-apigoogle-api-php-clientgoogle-workspacegoogle-admin-settings-api
Ozone Coders
Ozone Coders

Reputation: 11

have an error while sending invite email using google calendar api

Service accounts cannot invite attendees without Domain-Wide Delegation of Authority

I see the error and searched lot but no solution was useful for me and I still see the error. I don't have any issue on creating an event with service account but can't invite any user

I already added my client id in the Security > Access and data control > API Controls. In the Domain wide delegation pane, Manage Domain Wide Delegation. No changes I see

I already followed these steps and no changes applied.

From your Google Workspace domain’s Admin console, go to Main menu menu > Security > Access and data control > API Controls.

In the Domain wide delegation pane, select Manage Domain Wide Delegation.

Click Add new.

In the Client ID field, enter the service account’s Client ID. You can find your service account’s client ID in the Service accounts page.

In the OAuth scopes (comma-delimited) field, enter the list of scopes that your application should be granted access to. For example, if your application needs domain-wide full access to the Google Calendar API, enter: https://www.googleapis.com/auth/calendar

Click Authorize.

Upvotes: 0

Views: 191

Answers (2)

Akanksha agrawal
Akanksha agrawal

Reputation: 1

1. Grant domain-wide delegation to the Service Account:- Go to Security -> API Controls -> Domain-wide Delegation -> Add new -> Set the client ID of your service account,

Add scopes:- https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/calendar.events,https://www.googleapis.com/auth/admin.directory.resource.calendar

2. Build your credentials in the following way:-

GoogleCredential.Builder() .setTransport(HTTP_TRANSPORT) .setJsonFactory(JSON_FACTORY) .setServiceAccountId(credentials.getServiceAccountId()) .setServiceAccountPrivateKey(credentials.getServiceAccountPrivateKey()) .setServiceAccountUser("user@email-address") .setServiceAccountScopes(CalendarScopes.CALENDAR, CalendarScopes.CALENDAR_EVENTS) .build();

Upvotes: 0

Rene Olivo
Rene Olivo

Reputation: 536

What seems to be going on here is that although the domain wide delegation has been done correctly no impersonation is being done on the code itself.

The impersonation actually happens directly from the code as its purpose is to determine which user sends the calendar invite since the service account is not really a user.

For the actual setup I believe this might come in handy: https://github.com/googleapis/google-api-php-client/blob/main/docs/oauth-server.md#preparing-to-make-an-authorized-api-call:~:text=If%20you%20have%20delegated%20domain%2Dwide%20access%20to%20the%20service%20account%20and%20you%20want%20to%20impersonate%20a%20user%20account%2C%20specify%20the%20email%20address%20of%20the%20user%20account%20using%20the%20method%20setSubject

I hope it helps!

Upvotes: 0

Related Questions