Youtube Analytics API returns 403 forbidden even if token is valid

Question

I have an issue with access to Youtube Analytics API for random youtube channels.

After a successful authorization with following scopes:

I'm saving the token and refresh token in the database. Everything works well for some time. After a while (eg. three months) when my app makes a request, Google returns 403:

{
  "error": {
    "errors": [
      {
        "domain": "global",
        "reason": "forbidden",
        "message": "Forbidden"
      }
    ],
    "code": 403,
    "message": "Forbidden"
  }
}

but only for Youtube Analytics API, other endpoints in Youtube Data API works fine with this token. That happen for random accounts (channels). Owners of this channels didn't revoke access to my app, didn't change account password etc.

This issue affects about 40% of all channels in my application (the time when Youtube Analytics API stops working is different, from 1 to 6 months after obtaining OAuth2 token). Then I have to send them periodically a new authorization url.

Where is the problem?

This is how I generate an auth url and make requests:

Auth URL:

flow = client.flow_from_clientsecrets(
    secret_file_path,
    scope=["https://www.googleapis.com/auth/youtube.readonly",
           "https://www.googleapis.com/auth/yt-analytics.readonly"],
    redirect_uri=redirect_url,
    prompt="consent"
)
flow.params["access_type"] = "offline"
url = flow.step1_get_authorize_url(state=state)

Stats request:

auth = client.OAuth2Credentials.from_json(credentials_from_db)
http_auth = auth.authorize(httplib2.Http())
api = discovery.build("youtubeAnalytics", "v1", http=http_auth,
                   cache_discovery=False)
api.reports().query(
    ids="channel==%s" % channel_id,
    metrics="estimatedMinutesWatched",
    dimensions="video",
    start_date=start_date,
    end_date=end_date,
    max_results=20,
    filters="video=={}".format(",".join(video_ids))
).execute(http=http)

I'm using google-api-python-client 1.6.5

Edit

I attached screenshot while debugging requests to google API using google-api-python-client. Here's what's going on:

Retrieving channel's base stats using Youtube Data API
Retrieving channel's advanced stats using Youtube Analytics API

My point is that, the refresh token is successfully exchanged in both cases but works only with Youtube Data API. I purposely exchange it twice. The same result is when I access only Youtube Analytics API with one successful token exchange (without calling Youtube Data API).

And the most fun part is that, this code works for some time (a couple weeks or months) and then stops :-)

Is there a quota limit on API requests or something? I am saying this because while using Google Cloud Vision API I had a similar problem: because of exhausting my quota for that time frame. — unholy_me
@unholy_me Limits are fine, about 30-40% usage (for all kind of limits). — User
How often are you making calls to the api Using the refresh token for these users? — DaImTo
@DaImTo it depends; sometimes once a week and sometimes once a day. However refresh token is always successfully exchanged to auth token in all cases (i debugged it :-). — User
And you are using it to make calls against both apis this often? Could the User be authenticating your application more then once? Is it possible to have multiple installations? — DaImTo

DaImTo DaImTo · Accepted Answer · 2018-06-05T08:18:24

Ok lets start with a little background information.

There are sevral reasons why a refresh token would stop working.

It gets to old refresh tokens expire after six months if not used.
A user can reauthecate your application and get a new refresh token both refresh tokens will work you can have a max of fifty outstanding refresh tokens then the first will stop working.
the user can revoke your access.
Wakey daylight savings time bug of 2015. (we wont talk about that)

Now none of this is the case for you. Why because the refresh token still works your just drooping a scope. Which is crazy a user cant remove your access to one scope and it wont expire one scope.

That being said i am leading towards this being a bug. I have sent an email off to someone I know who is on the Oauth team.

In the mean time. I have an idea?

What happens if you try and request a new access token using the refresh token? Could it be an issue with the access token that was returned to you?

Youtube Analytics API returns 403 forbidden even if token is valid

2 Answers