Issue Authenticating GA4 Analytics Data API with Service Account

Question

I've been trying to call the Analytics Data API using a service account for authentication.

To do so, I have

1. Enabled the Google Analytics Data API on a GCP project
2. Created a service account in the credentials section of the Google Analytics Data API on the GCP console
3. Created and downloaded the JSON key file created from the service account
4. Set GOOGLE_APPLICATION_CREDENTIALS to the path of the JSON key file
5. Added the service account as an administrator to an Analytics account with a GA4 property I have access to

Unfortunately, whenever I try to run any Python scripts using the BetaAnalyticsDataClient, no matter which resource endpoint I try I end up getting this error

  response = client.run_report(request)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/blah/newenv/lib/python3.11/site-packages/google/analytics/data_v1beta/services/beta_analytics_data/client.py", line 518, in run_report
    response = rpc(
               ^^^^
  File "/blah/newenv/lib/python3.11/site-packages/google/api_core/gapic_v1/method.py", line 113, in __call__
    return wrapped_func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/blah/newenv/lib/python3.11/site-packages/google/api_core/timeout.py", line 120, in func_with_timeout
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/blah/newenv/lib/python3.11/site-packages/google/api_core/grpc_helpers.py", line 74, in error_remapped_callable
    raise exceptions.from_grpc_error(exc) from exc
google.api_core.exceptions.DeadlineExceeded: 504 Deadline Exceeded

I've even tried https://github.com/googleapis/python-analytics-data/blob/main/samples/snippets/get_common_metadata.py which uses some global internal property, but still get a DeadlineExceeded error.

I've also tried BetaAnalyticsDataClient.from_service_account_file("the_file") when initializing the client in hopes this would work.

Additionally as a test - although I have no clue if this should even work - have tried:

1. gcloud auth activate-service-account --key-file the-service-account-json-key.json
2. gcloud auth application-default print-access-token prints an access token

curl -X GET \                                     
  -H "Authorization: Bearer "$(gcloud auth application-default print-access-token) \
  -H "Content-Type: application/json; charset=utf-8" \
  https://analyticsdata.googleapis.com/v1beta/properties/0/metadata

which returns

{
  "error": {
    "code": 403,
    "message": "Request had insufficient authentication scopes.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT",
        "domain": "googleapis.com",
        "metadata": {
          "method": "google.analytics.data.v1beta.BetaAnalyticsData.GetMetadata",
          "service": "analyticsdata.googleapis.com"
        }
      }
    ]
  }
}

and have tried this on the property which I gave the service account administrator access.

Is there something else I need to enable for service accounts to work?

Answer 1

Its hard to help without seeing your code but the error message is telling you what the issue is Request had insufficient authentication scopes.

When making a request you need to be authorized with one of the following scopes.

• https://www.googleapis.com/auth/analytics.readonly
• https://www.googleapis.com/auth/analytics

Fix your scope and try again.