Why does ServiceAccountCredential fail with invalid credentials?

Question

Based on this prior question: where can i find ServiceAccountCredential

I created my own service account, downloaded the .p12 key, enabled datastore.

But I still get this error:

Unhandled Exception: Google.GoogleApiException: Google.Apis.Requests.RequestErro
r
Invalid Credentials [401]
Errors [
        Message[Invalid Credentials] Location[Authorization - header] Reason[aut
hError] Domain[global]
]

   at Google.Apis.Requests.ClientServiceRequest`1.Execute() in c:\code\google.co
m\google-api-dotnet-client\default\Tools\Google.Apis.Release\bin\Debug\test\defa
ult\Src\GoogleApis\Apis\Requests\ClientServiceRequest.cs:line 93
   at TestDotNet.Program.Main(String[] args) in C:\Users\jeff\rgs\udemy\TestDotN
et\Program.cs:line 42

Here's the code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

// Install-Package Google.Apis.Datastore.v1beta2
using Google.Apis.Auth.OAuth2;
using Google.Apis.Http;
using Google.Apis.Services;
using Google.Apis.Datastore.v1beta2;
using Google.Apis.Datastore.v1beta2.Data;
using System.Security.Cryptography.X509Certificates;

namespace TestDotNet
{
    class Program
    {
        static void Main(string[] args)
        {
            var certificate = new X509Certificate2(
                @"surferjeffEasyBates-ce8b875830c2.p12",
                "notasecret", X509KeyStorageFlags.Exportable);
            var serviceAccountEmail = "340967622364-pls45ap9lu4u6ivtivpus62tm8sgtodg@developer.gserviceaccount.com";
            ServiceAccountCredential credential = new ServiceAccountCredential(
               new ServiceAccountCredential.Initializer(serviceAccountEmail)
               {
                   Scopes = new[] { DatastoreService.Scope.Datastore }
               }.FromCertificate(certificate));
            var service = new DatastoreService(new BaseClientService.Initializer
            {
                ApplicationName = "surferjeffEasyBates",
                HttpClientInitializer = credential, 
            });
            var lookup_body = new LookupRequest()
            {
                Keys = new Key[] { new Key() { Path = new KeyPathElement[] { new KeyPathElement() {
                    Id = 1,
                    Kind = "Thing"
                }}}}
            };
            var lookup = new DatasetsResource.LookupRequest(service, lookup_body, "surferjeff-easybates");
            var response = lookup.Execute();
            var found = response.Found[0];
            var entity = found.Entity;
        }
    }
}

I get the same error no matter whether I run on a google compute engine instance or my local machine.

score 3 · Answer 1 · answered Feb 18 '15 at 22:17

You are just missing a required scope for Cloud Datastore. In addition to the datastore SCOPE, it requires 'userinfo.email'

If you actually want run inside GCE, you can simply use "ComputeCredentials" as shown here.

remember to set datastore and userinfo scopes while creating the instance

Add a Google Compute Engine instance and start it, following the instructions for starting an instance in the Google Compute Engine documentation. In addition to the project ID and the instance name, you must also specify both the datastore anduserinfo.email scopes as shown here.

The scopes line should be the following :

Scopes = new[] { DatastoreService.Scope.Datastore ,"https://www.googleapis.com/auth/userinfo.email"}

Why does ServiceAccountCredential fail with invalid credentials?

1 Answers1