google service account example returns "Error refreshing the OAuth2 token { “error” : “invalid_grant” }"

Question

My goal is to make the simplest query on Google Fusion Tables on behalf of my web app users. For that, I created a service account on google console. Here is the code:

    // Creating a google client
    $client = new \Google_Client();


    // setting the service acount credentials
    $serviceAccountName = 'XXXXX.apps.googleusercontent.com';
    $scopes= array(
                'https://www.googleapis.com/auth/fusiontables',
                'https://www.googleapis.com/auth/fusiontables.readonly',
                );
    $privateKey=file_get_contents('/path/to/privatekey.p12');
    $privateKeyPassword='notasecret'; // the default one when generated in the console

    $credential = new \Google_Auth_AssertionCredentials($serviceAccountName,
            $scopes, $privateKey, $privateKeyPassword);

    // setting assertion credentials
    $client->setAssertionCredentials($credential);

    $service = new \Google_Service_Fusiontables($client);
    $sql = 'select name from XXXXXXXX'; 
    $result = $service->query->sql($sql);

After running this code, I got this error:

Error refreshing the OAuth2 token, message: '{
"error" : "invalid_grant"
}'

I googled that for days and most of answers are talking about refreshing the token. I made this refresh but still the same errors!

Any idea for solving this problem? Thanks

Solution 1

I know that many people are facing the same problem like mine. So, this is the solution after days of search on google.

The code I proposed has only one error: the client id is like an email similar to [email protected]

The second thing you have to do is to share the table you are quering in google fusion tables with the client id of the service account.

After that, thing will work perfectly.

I hope this would help other.

Solution 2

In my case it was caused by the server's time being too far off (about 5 minutes).

Although your issue is already solved, maybe this is of any help for someone who lands here in the future as the error returned by Google is the same.

Comments

[Mike Warren]

I am trying to do something like this, stackoverflow.com/questions/21470405/… , and it is giving me the same error!

[Amine Jallouli]

You should create the $client and set its credentials first, then use SpreadsheetService

[Mike Warren]

amine jallouli could you elaborate on this, as an answer to this question I just posed: stackoverflow.com/questions/26965299/… ?

[Mike Warren]

What do you mean by creating the $client? What methods should I invoke, and what are the parameters?

[Amine Jallouli]

In my question, I gave how to create de \Google_Client(), then \Google_Auth_AssertionCredentials and finally the \Google_Service_Fusiontables. You have to follow these steps. For your case, you will use ` Google\Spreadsheet\SpreadsheetService`.

[Jared Eitnier]

I was trying to use my account email vs the service account email. Makes a world of difference!

[Bhupender Keswani]

How to check if my machine time is different. Please help

[Bjorn]

@BhupenderKeswani the easiest way to keep your server's time in sync is to use NTP. To check the current time on the server, use the date command.

[Mino]

Wow, thanks for the tip Bjorn. I had tried many other possibilities. :)