Google .Net Service Account access to Calendar

Question

I am updating a web service application that calls Google's calendar API's to list calendar events for a particular calendar and insert new calendar events. I am trying to upgrade it to version 3 of the api's. For authentication I am using a Service Account Credential that I created in the Google Developers Console (https://console.developers.google.com). I am able to create the CalendarService using the following code :

using System;
using Google.Apis.Auth.OAuth2;
using System.Security.Cryptography.X509Certificates;
using Google.Apis.Services;
using Google.Apis.Calendar.v3;
using Google.Apis.Calendar.v3.Data;

...

        string SERVICE_ACCOUNT_EMAIL = 
         "....googleusercontent.com";
        string SERVICE_ACCOUNT_PKCS12_FILE_PATH = @"C:\temp\API Project-123456789.p12";

        // Create the service.

        X509Certificate2 certificate = new X509Certificate2(SERVICE_ACCOUNT_PKCS12_FILE_PATH, "notasecret", X509KeyStorageFlags.Exportable);

        ServiceAccountCredential credential = new ServiceAccountCredential(
                   new ServiceAccountCredential.Initializer(SERVICE_ACCOUNT_EMAIL)
                   {
                       Scopes = new[] { CalendarService.Scope.Calendar }
                      , User = "something@mycompany.com"

                   }.FromCertificate(certificate));

        // Create the service.
        var cs = new CalendarService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = credential,
            ApplicationName = "Calendar API Sample",
        });

But when I call the list method to query a public calendar:

Events events = service.Events.List("something@mycompany.com").Execute();

A TokenResponseException is thrown with the following error message:

Error:"invalid_grant", Description:"", Uri:""

FYI : I have gone into the AdminHome for my company and under security Manage clients API Access and registered the SERVICE_ACCOUNT_EMAIL above to http://www.google.com/calendar/feeds/.

Any help with this would be greatly appreciated.

http://www.google.com/calendar/feeds/ is the old scope, you will need to include https://www.googleapis.com/auth/calendar instead. There is a Drive documentation on service account delegation which can be directly mapped into Calendar: https://developers.google.com/drive/web/delegation — luc, Nov 19 '14 at 23:41

score 0 · Answer 1 · edited May 23 '17 at 12:27

I believe you need to register the Client ID of the service account of your App, I have successfully got it working using this difference.

Here is a similar issue I resolved with inserting events. Google API Calender v3 Event Insert via Service Account using Asp.Net MVC

Here is the google documention on domain-wide-authorization. https://developers.google.com/+/domains/authentication/delegation

Google .Net Service Account access to Calendar

1 Answers1