Get hands-on experience with 20+ free Google Cloud products and $300 in free credit for new customers.

'Error 403: User not authorized to perform this action'

I have tried running my Python code in PyCharm which aims to read my client's emails (both recent emails and real time emails). I am currently testing this on my own Gmail account. My script is attempting to use the Gmail API's watch feature to receive real time email notifications.

I am using a main script (main.py) and another dedicated to the webhook process (webhook.py).

However, every time I run my main python script the following error message appears (even though every other section of my code is functioning perfectly - which deals with reading the current unread emails in the inbox). 
 
*(Actual project ID replaced with '(PROJECT ID)'
 
An error occurred: <HttpError 403 when requesting https://gmail.googleapis.com/gmail/v1/users/me/watch?alt=json returned "Error sending test message to Cloud PubSub projects/(PROJECT ID)/topics/gmail-notifications : User not authorized to perform this action.". Details: "[{'message': 'Error sending test message to Cloud PubSub projects/(PROJECT ID)/topics/gmail-notifications : User not authorized to perform this action.', 'domain': 'global', 'reason': 'forbidden'}]">

It is unclear to me what is causing an unauthorized access error when the permissions/roles for my service account should be sufficient (listed below). What could be the cause of this issue and how do you resolve this error message?

Additional information:
-When I run my webhook.py script afterwards it appears to be functional with no error messages.
-These are the listed permissions for my service account: 
Cloud Pub/Sub Service Agent, Pub/Sub Admin, Pub/Sub Editor, Pub/Sub Publisher, Pub/Sub Subscriber. 
Permission for the user (my Gmail account): Owner
-Push notifications has been selected in the service account.
-Here are the scopes listed in my main script:
SCOPES = ['https://www.googleapis.com/auth/gmail.readonly',
'https://www.googleapis.com/auth/gmail.modify',
'https://www.googleapis.com/auth/gmail.metadata']
0 1 266
1 REPLY 1

Hi @bradendoescloud,

Welcome to the Google Cloud Community!

The reason why you received “403 User not authorized to perform this action” is due to a permission issue preventing the Gmail API from publishing to your Cloud Pub/Sub topic. You may refer to this documentation which provides possible solutions on how you will solve this error.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.