Oauth access to external Google Brand Account

Question

My company has a Google Brand Account to manage our YouTube (YT) channel. We are trying to use the YouTube Analytics & Reporting API to automatically export metrics about our channel. To do so, we have created an App in our GCP Organisation and in that App we have created an Oauth client. Everything works fine when retrieving YouTube data for a channel owned by a user within our GCP Org. However, the Brand Account that owns the YT channel we are interested in is not a member of our GCP Org. This means that when trying to access that channel using our Oauth client we get the following error:

Error 403: org_internal
This client is restricted to users within its organization.

From searching online documentation it seems that we can do one of the following:

Make our App external from the APIs & Services -> OAuth consent screen section Migrate the Brand Account to our GCP Org
I don't know how to do 2. and whether it is actually feasible at all. And 1. seems a bit overboard to me as we don't really want to access data from any user with a Google Account but it might be the only way. So I am looking for help on how best to proceed so that we can use an OAuth client within our GCP Org to get analytics data from our YT channel.

Erock618 Erock618 · Accepted Answer · 2021-02-17T20:22:40

Looks like this was first documented here. It's makred "won't fix" by Google, not sure why.

I was able to use this OAuth Playground (OAP) workaround to get my app to work. It's a pretty sad workaround because the token will only work for an hour and then you must manually refresh in the playground.

Once you get the token from OAP, here is the code I'm using.

import os, json
from pathlib import Path
import google.oauth2.credentials
from googleapiclient.discovery import build

# pasted from OAP, note only access_token is actually needed
Path('oap.json').write_text('''
{
  "access_token": "tokenstring", 
  "scope": "https://www.googleapis.com/auth/youtube.readonly https://www.googleapis.com/auth/yt-analytics.readonly", 
  "token_type": "Bearer", 
  "expires_in": 3599, 
  "refresh_token": "refreshtoken"
}
''')

TOKEN_FILE = 'oap.json'

# For Reference
# SCOPES = ['https://www.googleapis.com/auth/yt-analytics.readonly',
#           'https://www.googleapis.com/auth/youtube.readonly']

API_SERVICES = [
                ('youtubeAnalytics', 'v2'),
                ('youtube', 'v3')
                ]

oap = json.load(open(TOKEN_FILE, 'r'))
creds = google.oauth2.credentials.Credentials(oap['access_token'])

service_list = []
for API_SERVICE_NAME,API_VERSION in api_services:
    service = build(API_SERVICE_NAME, API_VERSION, credentials = creds)
    service_list.append(service)

ytAnalytics, ytData = service_list

# test ytData
req = ytData.channels().list(
    part = 'id,snippet',
    mine=True)
res = req.execute()
print(res)
for channel in res['items']:
    print('Channel:',channel['snippet']['title'])

Oauth access to external Google Brand Account

1 Answers