GTasks API Service Account: Client is unauthorized to retrieve access tokens using this method

Question

I have a service account with Domain wide delegation and its been working fine for Calendar APIs. I am able to impersonate as other users within the organization to CRUD events in Google Calendar without the Consent Screen. Now i'm trying to consume GTasks API but getting error.

For GTasks

credentials = service_account.Credentials.from_service_account_file('service-account.json', scopes=['https://www.googleapis.com/auth/tasks'])
delegated_credentials = credentials.with_subject('username@company.com')
service = build('tasks', 'v1', credentials=delegated_credentials)
tasklists = service.tasklists().list(maxResults=10).execute()

and got below error.

('unauthorized_client: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.', '{\n  "error": "unauthorized_client",\n  "error_description": "Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested."\n}')

For GCalendar, working fine

credentials = service_account.Credentials.from_service_account_file('service-account.json', scopes=['https://www.googleapis.com/auth/calendar'])
delegated_credentials = credentials.with_subject('username@company.com')
service = build('calendar', 'v3', credentials=delegated_credentials)
events = service.events().list(calendarId=SUBJECT,timeMin=now,maxResults=10,orderBy='startTime',singleEvents=True).execute()

I'm using this lib https://github.com/googleapis/google-api-python-client. Any hint what's wrong here?

Have you checked if you have Tasks API enabled in your project? Check on console.developers.google.com if the api is enabled and on admin.google.com if the users on your domain have Tasks on. — Kessy, Jan 07 '20 at 09:42

score 0 · Answer 1 · answered Jan 06 '20 at 20:54

Not all APIs support domain-wide delegation. If they do, you will see it mentioned in the Auth documentation.

The Calendar API supports domain-wide delegation, and the Tasks API does not.

score 0 · Answer 2 · answered Feb 13 '20 at 07:46

Google Calendar and Tasks both support domain wide-delegation, I am using that. My suggestion is:

Check if your developer console has enabled Google Tasks API
Check if you've added Google Tasks into your API permission scope in your G Suite admin dashboard. May refer https://developers.google.com/identity/protocols/OAuth2ServiceAccount for more detail

GTasks API Service Account: Client is unauthorized to retrieve access tokens using this method

2 Answers2