Gmail API using service account is getting delegation denied error message

1.3k Views Asked by At

I am developing a web-based application using Google API. I am using server-to-server which is obviously with a service account. I am almost done.

I can now insert new users through Google api. I can even create and/or give newly created users access to a Team Drive through Google API. Meaning, I have a service-account that can impersonate all domain users.

The Problem: But why am I getting errors when trying to impersonate a user through Gmail API? I need to add Gmail Labels and Filters to newly created users but I am getting an error message stating "Deligation denied". Am I missing something?

Obviously I have a working service-account settings already with proper scopes in G Suite. I guess userID "me" is not an option since my application needs to impersonate a newly created G Suite user. Please correct me if I am wrong.

$service = new \Google_Service_Gmail($this->client($scopes));

$serviceLabel = new \Google_Service_Gmail_Label();
$serviceLabel->setLabelListVisibility('labelShow');
$serviceLabel->setMessageListVisibility('show');
$serviceLabel->setName($label_name);

try {
    $resp = $service->users_labels->create($email, $serviceLabel);    
} catch (Google_Service_Exception $e) {
   return false;
}

Here is the error I am getting

{#398 ▼
  +"statusCode": 403
  +"errors": array:1 [▼
    0 => array:3 [▼
      "domain" => "global"
      "reason" => "forbidden"
      "message" => "Delegation denied for [email protected]"
    ]
  ]
  +"message": """
    {
     "error": {
      "errors": [
       {
        "domain": "global",
        "reason": "forbidden",
        "message": "Delegation denied for [email protected]"
       }
      ],
      "code": 403,
      "message": "Delegation denied for [email protected]"
     }
    }
    """
}

A Gmail Label is expected to be added automatically for each user being created through the application.

0

There are 0 best solutions below