Summary
Running auth login with the all preset produces credentials that can't query any health data. Every data command fails with 403 "Request contains disallowed OAuth scope(s)." The all preset includes the cloud-platform scope, and the data-plane endpoints reject any token that carries it.
Steps to reproduce
ghealth auth login --scopes-preset all
ghealth data steps daily-rollup --from 2026-06-25 --to 2026-07-02
Actual result
{
"error": {
"type": "api",
"status": 403,
"message": "Request contains disallowed OAuth scope(s).",
"hint": "Check that the Health API is enabled and you have the required OAuth scopes"
}
}A tokeninfo call confirms cloud-platform is present alongside the googlehealth.* scopes.
Cause
ScopePreset("all") in pkg/auth/auth.go:199 returns every entry in AllScopes, and cloud-platform is one of them (pkg/auth/auth.go:66). So all means every scope, including the webhook-admin one, which breaks reads.
This incompatibility is already documented, but only in the webhooks command help and the source comment at cmd/webhooks.go:50 ("a token carrying cloud-platform is REJECTED by the data-plane endpoints"). Nothing near setup, auth login, or the preset docs mentions it, so picking all looks like the obvious choice and quietly breaks data reads.
What worked for me
Excluding cloud-platform from the all preset so it only covers data scopes. Webhook admin still works through a separate --scopes cloud-platform login, which is the pattern the docs already describe.
Version: ghealth 0.1.0 (dev)
Summary
Running
auth loginwith theallpreset produces credentials that can't query any health data. Everydatacommand fails with403 "Request contains disallowed OAuth scope(s)."Theallpreset includes thecloud-platformscope, and the data-plane endpoints reject any token that carries it.Steps to reproduce
Actual result
{ "error": { "type": "api", "status": 403, "message": "Request contains disallowed OAuth scope(s).", "hint": "Check that the Health API is enabled and you have the required OAuth scopes" } }A tokeninfo call confirms
cloud-platformis present alongside thegooglehealth.*scopes.Cause
ScopePreset("all")inpkg/auth/auth.go:199returns every entry inAllScopes, andcloud-platformis one of them (pkg/auth/auth.go:66). Soallmeans every scope, including the webhook-admin one, which breaks reads.This incompatibility is already documented, but only in the
webhookscommand help and the source comment atcmd/webhooks.go:50("a token carryingcloud-platformis REJECTED by the data-plane endpoints"). Nothing nearsetup,auth login, or the preset docs mentions it, so pickingalllooks like the obvious choice and quietly breaks data reads.What worked for me
Excluding
cloud-platformfrom theallpreset so it only covers data scopes. Webhook admin still works through a separate--scopes cloud-platformlogin, which is the pattern the docs already describe.Version: ghealth 0.1.0 (dev)