service account with owner rights has insufficient permissions

Hello,

I finally managed to make a successful api call with this npm package;
publisher.inappproducts.list({ ... returns the expected result and everything is great.
But when I go for:

publisher.purchases.subscriptions.get({ 
  packageName: packageName, 
  subscriptionId: subscriptionId, 
  token: token
}) ...

It always returns the same error:
The current user has insufficient permissions to perform the requested operation.
Assuming that:

• The current user is a service account with the highest possible permissions granted in both the developer console and the google play console. (including "view financial data")
• The project in the google developer console is linked to the app in the google play console.
• The packageName, subscriptionId and token parameters sent are valid.

What could possibly be missing?
Is a refresh_token needed with service accounts?
Could there be discrepancy between the permissions shown in the UI and the actual permissions granted to the service account?
Does the service account need to "accept" the invitation to be a "owner"?
Is there a way to list the service account's permissions through the API?

Here is the code I use for authentication:

const {google} = require('googleapis');

async function main () {
    // This method looks for the GCLOUD_PROJECT and GOOGLE_APPLICATION_CREDENTIALS
    // environment variables.
    const auth = await google.auth.getClient({
        // Scopes can be specified either as an array or as a single, space-delimited string.
        scopes: ['https://www.googleapis.com/auth/androidpublisher']
    });

    // obtain the current project Id
    const project = await google.auth.getProjectId();

    const publisher = google.androidpublisher({
        auth: auth,
        version: 'v3',
        project: project
    });
...

Environment details

• OS: OSX 10.14 (Mojave)
• Node.js version: 8.11.4
• npm version: 5.6.0
• googleapis version: 34.0.0

Thanks for making it down here.

[lfreneda]

@fel-dev any updates?

Hey @lfreneda ,

It finally worked, I don't remember what I changed exactly but saw this comment in my code:

// Didn't work, waited a few days, worked. Permissions probably need time to propagate.
publisher.purchases.subscriptions.get({
                packageName: packageName,
                ...

So maybe try waving a dead chicken over your code and come back a few days later, it worked for me!

[luboganchev]

@fel-dev I couldn't find any documentation that says "few days are required in order to propagate correctly the permissions". I also wrote an email to Google support asking a bunch of questions including this one but still no response from them. I did the same as you described in the issue - giving administrator permissions to my service account from both Developer console and the Google play console. Seems to be blocking issue with high priority since we are not able to validate in-app purchase within server side. Any updates what actually happens here?

@luboganchev Yeah, I also couldn't find any documentation about permissions needing time to propagate, maybe that's not the issue at all. But I remember quite clearly leaving the code aside for some more urgent task, then coming back to it a few days later and it all worked on first try before I changed anything. As unhelpful as that might be, it's really all I've got for you.

Again, I reserve myself the right to be wrong...

[luboganchev]

Thanks for your help of course but how we can escalate this problem and some tech guy from Google to take a look at this blocking issue?

[luboganchev]

Just to inform what's happening with my case. From the time when I setup full privileges to my service account to actual propagating the permissions from Google, it takes 24 hours. So if someone gives admin access to his/her own service account it should wait at least one day in order to verify In-App purchase from the server side. It will be great if Google representative document this behavior in order to be more transparent for further users.

[victorbadila]

any delay if this lagging happens for permission upgrades to other services as well? I am trying to setup domain wide delegation for connecting a service account with gsuite and ever though I followed every steps on every guide out there - Google wasn't very helpful in this regard - I still get unauthorized calls citing lack of permissions.

[luboganchev]

any delay if this lagging happens for permission upgrades to other services as well? I am trying to setup domain wide delegation for connecting a service account with gsuite and ever though I followed every steps on every guide out there - Google wasn't very helpful in this regard - I still get unauthorized calls citing lack of permissions.

Probably for each Google service is implemented the same permissions propagating functionality with some Message Queue or Background Job running on some interval of time.

[purificant]

I had the same problem: The current user has insufficient permissions to perform the requested operation.

It was resolved after waiting for 24-48 hours without touching the code. The same code / access key that was denied access previously suddenly started working. I am not exactly sure how long the wait has to be, in my experience it is closer to the 48h mark.

P.S. My sample code in Python:

import httplib2

from googleapiclient.discovery import build
from oauth2client.service_account import ServiceAccountCredentials

credentials = ServiceAccountCredentials.from_json_keyfile_name('api.json', scopes='https://www.googleapis.com/auth/androidpublisher')

http = httplib2.Http()
http = credentials.authorize(http)

service = build("androidpublisher", "v3", http=http)
purchases = service.purchases()
subscriptions = purchases.subscriptions()
get = subscriptions.get(
    packageName='foo',
    subscriptionId='bar',
    token='baz'
)
result = get.execute()
print(result)