google service account example returns "Error refreshing the OAuth2 token { “error” : “invalid_grant” }"

Question

My goal is to make the simplest query on Google Fusion Tables on behalf of my web app users. For that, I created a service account on google console. Here is the code:

    // Creating a google client
    $client = new \Google_Client();


    // setting the service acount credentials
    $serviceAccountName = 'XXXXX.apps.googleusercontent.com';
    $scopes= array(
                'https://www.googleapis.com/auth/fusiontables',
                'https://www.googleapis.com/auth/fusiontables.readonly',
                );
    $privateKey=file_get_contents('/path/to/privatekey.p12');
    $privateKeyPassword='notasecret'; // the default one when generated in the console

    $credential = new \Google_Auth_AssertionCredentials($serviceAccountName,
            $scopes, $privateKey, $privateKeyPassword);

    // setting assertion credentials
    $client->setAssertionCredentials($credential);

    $service = new \Google_Service_Fusiontables($client);
    $sql = 'select name from XXXXXXXX'; 
    $result = $service->query->sql($sql);

After running this code, I got this error:

Error refreshing the OAuth2 token, message: '{
"error" : "invalid_grant"
}'

I googled that for days and most of answers are talking about refreshing the token. I made this refresh but still the same errors!

Any idea for solving this problem? Thanks

Ventriloquism

Answer 1

I know that many people are facing the same problem like mine. So, this is the solution after days of search on google.

The code I proposed has only one error: the client id is like an email similar to [email protected]

The second thing you have to do is to share the table you are quering in google fusion tables with the client id of the service account.

After that, thing will work perfectly.

I hope this would help other.

Ventriloquism

I am trying to do something like this, #21470905 , and it is giving me the same error! – Hercegovina

You should create the $client and set its credentials first, then use SpreadsheetService – Ventriloquism

amine jallouli could you elaborate on this, as an answer to this question I just posed: #26965799 ? – Hercegovina

What do you mean by creating the $client? What methods should I invoke, and what are the parameters? – Hercegovina

In my question, I gave how to create de \Google_Client(), then \Google_Auth_AssertionCredentials and finally the \Google_Service_Fusiontables. You have to follow these steps. For your case, you will use ` Google\Spreadsheet\SpreadsheetService`. – Ventriloquism

I was trying to use my account email vs the service account email. Makes a world of difference! – Thenar

Answer 2

In my case it was caused by the server's time being too far off (about 5 minutes).

Although your issue is already solved, maybe this is of any help for someone who lands here in the future as the error returned by Google is the same.

Zadazadack

How to check if my machine time is different. Please help – Sedan

@BhupenderKeswani the easiest way to keep your server's time in sync is to use NTP. To check the current time on the server, use the date command. – Zadazadack

Wow, thanks for the tip Bjorn. I had tried many other possibilities. :) – Perreira

Answer 3

I got same error in google analytic API, I have solved it by adding my Service accounts Email address with google analytic account.

Historiographer