How to grant gmail access to a service account

[Sap]

Both ChatGPT and Bard give the following instructions, however there are no roles related to Gmail. So has anything changed or is there another way?

When trying to use the service account currently, I get the following error:
googleapiclient.errors.HttpError: <HttpError 400 when requesting https://gmail.googleapis.com/gmail/v1/users/me/profile?alt=json returned "Precondition check failed.". Details: "[{'message': 'Precondition check failed.', 'domain': 'global', 'reason': 'failedPrecondition'}]

To give the service account access to read Gmail emails, you need to grant it the Gmail API Viewer role. You can do this by following these steps:

1. In the Google Cloud Platform Console, click the IAM & Admin tab.
2. Click the Roles tab.
3. In the search bar, enter Gmail API Viewer.
4. Click the Gmail API Viewer role.
   
   
   

[Flaborea]

Hi @Sap ! How are you doing? Could you solve your problem? There's a complete guide on how to enable the API and configure Authentication & Authorization in order to use the workspace APIs, including Gmail, here -> https://developers.google.com/workspace/guides/auth-overview
Please, let me know if it helps!

DF

[Surge]

I spent the last two days digging in the documentation, but have not been able to find what looks like a reasonable solution. I would like to grant limited access to one mailbox only to a service account (so the app can run as a batch/background process and authenticate with a JWT). This should work regardless of whether the account is a personal or a Workspace account, so the app can be used to do email management by any GMail user. It looks like the only options are domain-wide delegation (which is not acceptable, per above) or an OAuth flow, which authorizes the possessor of a refresh token, rather than a service account. In looks like there should be a GMail API Viewer (or Manager) Role, that I should be able to grant to the service account, but I am not able to find any, as mentioned above.

Please help!

[bhavya0598]

I am in the same boat. Please help

[SimoneJarno]

I have the same issues, I would like to read mail that will be sent to that service account mail, or the personal account mail. (using the service account)
Did you find any solution?

[Surge]

Zero progress so far.

[Sap · Accepted solution]

I have pretty much a guide on readme of one of scripts here: https://github.com/sapn1s/gmail-email-checker

You do not need gmail.modify permission if you just want to read the emails.

Just for running on server without gui, you need to open the auth URL on an actual browser anywhere and just paste the code, after that it would remember your session.

[SimoneJarno]

I just found this solution and used it.
So my program will work without needing to open another auth URL again?

[Sap]

yep, its needed only once, at least for me it didn't ever ask again yet, as far as you have the token.js file saved from first launch

[SimoneJarno]

thank u, appreciate it

[SahithSadhe]

Hey , I am facing the same issue here...is there any expiry for the token.js file?

[Sap]

Hey, yes, if you check token.json file content you will see "expiry_date" field which tells you when the token will expire. 

However, I just updated the github repo to automatically refresh the token if it is expired, so you won't need to worry about it. 👌

[SimoneJarno]

Hi, There shouldn't be any expiry for the token.js file

I remember that in my code I had to change to the correct function that load the token.js file

In my case im using Credentials.from_authorized_user_file('token.js', scopes=SCOPES)

And maybe there is a needed modification in the token.js too

Should start with {"token"... And not {"web"...

[bhavya0598]

for how many days will it remember our session?