Using Google People API with Service Account

Question

I'm using the Google People API to access my contacts.

I activated it in the Google Developers Console and created a project, a service account (ending with ....iam.gserviceaccount.com) and a key for authentication which is stored in JSON format.

When I access the contacts, it seems to take the contacts of my service account address rather than my Google account which results in an empty list.

How can I tell the API to use my account rather than the service account?

This is the code I have so far:

from google.oauth2 import service_account
from googleapiclient.discovery import build
# pip install google-auth google-auth-httplib2 google-api-python-client

SCOPES = ['https://www.googleapis.com/auth/contacts.readonly']
KEY = '~/private.json'

credentials = service_account.Credentials.from_service_account_file(
    KEY, scopes=SCOPES)
service = build(
    serviceName='people', version='v1', credentials=credentials)
connections = service.people().connections().list(
    resourceName='people/me', personFields='names').execute()

print(connections)
# result: {}

Mica

Answer 1

A service account is NOT you a service account is a dummy user it has its own google drive account, google calendar and apparently google contacts. The reason that you are seeing an empty result set is that you have not added any contacts to the service accounts account.

Service accounts are most often used to grant access to data that the developer owns. For example you can take the service account email address and share one of your folders on google drive it will then have acccess to that folder on your google drive account. You can do the same with google calendar.

There are some apis that do not give you the ablity to share your data with other users. Youtube, adwords, blogger and google contacts to name a few.

You cant use a service account to access your personal google contacts. Your best bet would be to authenticate your application with oauth2 and access them that way.

Note about Google Workspace

If you have a google workspace account, a serivce account can be configured to act on behalf of a user on the domain, but only a user on the domain. Perform Google Workspace domain-wide delegation of authority

Circumstantiality

This other answer https://mcmap.net/q/1907423/-using-google-people-api-with-service-account is not correct? Can't you give the service account domain wide access, then impersonate the user and access whatever resource he has including contacts, youtube, etc? – Tenement

If you have a google workspace account, you can configure a service account to impersonate a user. Then any action preformed by the service account would be on behalf of the user. This would include adding to the users google contacts, and probably youtube although i have not tried that. – Circumstantiality

Answer 2

Not a python expert but I've just performed the task the OP is talking about in .NET and I am pretty sure it's feasable with Python too.

So it looks like all needs to be done is delegating domain-wide authority to the SA. I.e. assign required scopes for your SA, in my case it was https://www.googleapis.com/auth/contacts.readonly.

Then you should do your call and specify an account you're trying to impersonate (took the python example from here)

from google.oauth2 import service_account

SCOPES = ['https://www.googleapis.com/auth/sqlservice.admin']
SERVICE_ACCOUNT_FILE = '/path/to/service.json'

credentials = service_account.Credentials.from_service_account_file(
        SERVICE_ACCOUNT_FILE, scopes=SCOPES)

# this is the line you apparently were missing
delegated_credentials = credentials.with_subject('[email protected]')

Then you'll be able to do the people/me calls. Worked for me in .NET as I said.

Evy

Does not work for me, I have no idea why. The authorize step works. but when searching contact I get Insufficient Permission – Tenement

Note: Delegation can only be preformed on google workspace accounts, not on standard google account. – Circumstantiality

I am using workspace account. My problem was the wrong url. Thanks! – Tenement