How to use a cross-project service user to auth in Google Play Developer API

Question

In my current setup, I am only able to have a service account in a shared project called ProjectA. This project is solely used for creating Service Accounts (SA). Afterwards, I invite the SA to my own project, ProjectB, which creates what is known as a cross-project SA.

Within ProjectB, I have enabled the Google Developer API, specifically the Google Developer API for Android Publisher. To authenticate and perform the desired actions, I am using the .NET Google Client Library, which can be found here.

However, I am encountering an issue when establishing the OAuth2 connection using the SA’s JSON key file and creating the API service. Even though I provide the ProjectB ID, I receive an error stating that ProjectA does not have the API enabled.

This is how I'm creating the ServiceAccount credential in my script:

      public static GoogleCredential GetCredential()
 {
     string[] APIscopes = new string[] { AndroidPublisherService.Scope.Androidpublisher  };

     GoogleCredential credential = GoogleCredential.FromFile(KEY_FILE).CreateScoped(APIscopes);

     return credential;
 }

And this is how I am creating my google developer api service:

public static AndroidPublisherService GetService()
{

    AndroidPublisherService service = new AndroidPublisherService(new BaseClientService.Initializer()
    {
        HttpClientInitializer = GetCredential(),
        ApplicationName = ProjectID
    });
    //Console.WriteLine(service.ApplicationName);
    return service;
}

And I only receive the error when callling:

service.Users.List("developers/*").Execute();

The error:

Google.GoogleApiException HResult=0x80131500 Message=The service androidpublisher has thrown an exception. HttpStatusCode is Forbidden. Google Play Android Developer API has not been used in project PROJECTA_ID before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/androidpublisher.googleapis.com/overview?project=PROJECTAID then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.

Answer 1

Based on the error, it might be that the cause of the error in the service account (Project A) does not have the Google Play Android Developer API enabled, even though you've enabled it in Project B. This is because cross-project service accounts inherit permissions from their parent project, not the project they're invited to.

You can try this steps to fix the issue:

1. You can check if the "Google Play Android Developer API" is enabled in Project A

2. Check the permissions in the said service account. Ensure that the service account has the permission to access the AndroidPublisherService.

3. Explicitly Set Project ID for API Calls