How to use google reseller api using service account

Question

I want to access Google reseller api to get customers and subscriptions using google service account key but not able to do it. Below is my code snippet:

async function runSample() {
    const auth = new google.auth.GoogleAuth({
        keyFile: "../server/credentials/serviceAccountKey.json",
        scopes: ["https://www.googleapis.com/auth/apps.order",
            "https://www.googleapis.com/auth/apps.order.readonly"
        ],
    });
    // Acquire an auth client, and bind it to all future calls
    const authClient = await auth.getClient();
    google.options({ auth: authClient });

    // Do the magic
    const res = await reseller.subscriptions.list();
    console.log(res.data);
}
runSample().catch(console.error);

Here I want to get list of the subscription from google reseller console. I referenced above code from google documentation. Here I am getting the error 'Authenticated user is not authorized to perform this action.' and reason given is 'Insufficient permissions'.

errors: [
    {
      message: 'Authenticated user is not authorized to perform this action.',
      domain: 'global',
      reason: 'insufficientPermissions'
    }
  ]

If I try to access cloud channel service api I can using the same service account key but it is giving error for reseller api.

I have given service account the owner, cloud workstation admin and service account admin role access. I have also added scopes in domain wide delegation(dwd). What else permission do I need?

Answer 1

In order to use a service account it must first be configured though your google workspace account Create a service account

You must also denote in your code the name of the user who your service account has been configured to impersonate.

const auth = new google.auth.GoogleAuth({
    keyFile: "../server/credentials/serviceAccountKey.json",
    clientOptions: {
  subject: '[email protected]'
},
    scopes: ["https://www.googleapis.com/auth/apps.order"
    ],
});