403 insufficient permission for gmail api with python

Question

i am trying to run the gmail API to get email from a specif user. However i always receive the following error: googleapiclient.errors.HttpError: https://www.googleapis.com/gmail/v1/users/me/settings/filters?alt=json returned "Insufficient Permission">

I have tried all the different options suggested from changing the scope to enabling the less secure applications in the gmail setting. The last thing is that my code could be wrong:

from __future__ import print_function
from googleapiclient import discovery
from googleapiclient.discovery import build
from httplib2 import Http
from oauth2client import file, client, tools

# Setup the Gmail API
SCOPES = 'https://mail.google.com/'
store = file.Storage('credentials.json')
creds = store.get()
if not creds or creds.invalid:
    flow = client.flow_from_clientsecrets('client_secret.json', SCOPES)
    creds = tools.run_flow(flow, store)
service = build('gmail', 'v1', http=creds.authorize(Http()))

# Call the Gmail API
    # results = service.users().labels().list(userId='me').execute()
    # labels = results.get('labels', [])
    # if not labels:
    #     print('No labels found.')
    # else:
    #     print('Labels:')
    #     for label in labels:
    #         print(label['name'])
label_id = 'mine' # ID of user label to add
filter = {
    'criteria': {
        'from': '[email protected]'
    }#,
    #'action': {
        #'addLabelIds': [label_id],
        #'removeLabelIds': ['INBOX']
    #}
}
result = service.users().settings().filters().create(userId='me', body=filter).execute()
print ('Created filter: %s' % result.get('id'))

Could please help me?

Thanks

RajSoundar RajSoundar · Accepted Answer · 2018-06-01T21:58:42

Just remove credentials.json file from the folder where you run this script from and rerun your script with the final desired list of scopes such as SCOPES = ['https://www.googleapis.com/auth/gmail.send', 'https://www.googleapis.com/auth/gmail.labels']. Authorize, at the resulting pop up browser window, the list of scopes for the desired gmail account. Then you should be all set.

Background story: It is likely you had authorized less permissive scopes (such as readonly) via the browser screen that popped up when your run_flow() ran first time. This would have created a file called credentials.json in the folder where you ran the script. This credentials.json is not again regenerated per your script above. It is just frozen with the first time scope. Just for curiosity, you can open and read the credentials.json and look for the key 'scopes'. Of course, you cannot add more scopes in this file manually and expect newer scopes to work. This has to be regenerated for different set of scopes if any.

Unrelated cautionary note: Avoid the too permissive scope https://mail.google.com/ if at all possible:)

403 insufficient permission for gmail api with python

3 Answers