App is not authorized to scopes after installing via chrome web store

0
votes

We are in the process of creating our new app for v2 of the apps marketplace. Recently we have run into quite a major issue and we are having a lot of trouble resolving it.

We are testing the workflow where a domain admin installs via the chrome webstore listing. The actual installation of the app works, insofar as the app is installed on the domain and the scopes appear to be granted when looking at the "Manage API client access" section in the domain admin panel (http://i.stack.imgur.com/a63nv.png).

However, when we attempt to use the service account to get calendar or contacts info, we are getting "Requested client not authorized" errors.

{
  "error" : "access_denied",
  "error_description" : "Requested client not authorized."
}

However, if we manually add our service account + scopes to the domain in question, then accessing the data programmatically works fine (http://i.stack.imgur.com/g6pRg.png).

So, clearly we are missing something here, with how installing a marketplace app via the chrome web store is supposed to work.

Other things to note:

  • Chrome webstore listing is marked as unlisted.
  • New marketplace app is not approved (obviously) as the tester received this specific error when attempting to install the marketplace app.
1
google-apps-marketplace
Please double check that the service account you are using is connected to the Google Developers Console project associated with you Apps Marketplace listing. – Eric Koleda

1 Answers

1
votes

We got it figured out. The issue was in how we declared our contacts API scope in the marketplace sdk setup screen.

In the marketplace setup screen, we declared using the contacts scope without a trailing slash ("https://www.google.com/m8/feeds").

However in our app, we were sending oauth requests for the calendar feed with the slash at the end. ("https://www.google.com/m8/feeds/"). This mismatch caused the whole request to fail with the error message above.

If anyone runs into this and is baffled at why their service account requests are failing, make sure you are consistent with your slashes at the end!

I would suggest to Google that you should update the marketplace sdk screen to also be consistent and reject scopes that do not have a slash at the end. That would have saved us days of frustration.