85

I have a Google dev console process with Google Play Developer API is enabled and the project is linked to Google Play project. In Google Dev console project, created OAuth Client ID (web application) (I'm an owner of the project). Using "client_id" and "client_secret" to authenticate. Tried to using google-api-client in Python, Google Developer API Playground to send request to list reviews of our apps but got error: "The current user has insufficient permissions to perform the requested operation." Details as below: Request:

GET /androidpublisher/v2/applications/<package_name>/reviews

Response:

"error": {
    "code": 401, 
    "message": "The current user has insufficient permissions to perform the requested operation.", 
    "errors": [
      {
        "domain": "androidpublisher", 
        "message": "The current user has insufficient permissions to perform the requested operation.", 
        "reason": "permissionDenied"
      }
    ]
  }
}

Did I miss anything?

13 Answers 13

215

There is one important thing about receipt validation using Google Play Android Developer API:

If you added your in-app product BEFORE granting permission or linking to your service account, you must open "In-app products" and change something. You can for example edit the description of your product and save it. You should instantly get the permission then.

23
  • 36
    This is the key. Damn you, Google. Any Google developer API experience has been trash but this takes the cake. Jul 27, 2020 at 10:21
  • 2
    This works for me. For addition, make some changes in Grow -> Store presence -> Main store listing or Monetize -> products -> In-app products/Subscriptions also take effect.
    – Wyn He
    Nov 10, 2020 at 11:02
  • 1
    Editing the description didn't work for me, creating and activating a new product did though (even for validating receipts for the old product).
    – Aulig
    Jan 29, 2022 at 14:51
  • 5
    This solution still valid to July-2022, lol :))
    – SLyHuy
    Jul 14, 2022 at 7:34
  • 4
    This indeed actually works still in 2023, kudos to you.
    – idish
    Jan 27 at 22:43
78

I looked everywhere on the internet and found somewhere that you might need to wait for at least 24 hours.

Ensure you have done everything correctly as below.

  1. Go to https://console.cloud.google.com
  2. Create a project (or select existing project)
  3. Create a service account with role Pub/Sub Admin
  4. Go to https://console.cloud.google.com/apis/library and search for "Google Play Android Developer API"
  5. Enable that API
  6. Go to https://play.google.com/apps/publish
  7. Go to Settings > Developer account > API Access
  8. Link the project that you created in step 2
  9. The service account will appear that you created in step 3
  10. Grant access to it with Finance permission to the app in play console
  11. Very important: Wait for at least 24 hours for changes to take effect.
7
  • "Create a service account with role Pub/Sub Admi" I don't see how to add that role? Is this still valid? I already created the service account and I am getting the error mentioned here.
    – salyela
    Jun 13, 2019 at 18:52
  • @salyela When you create a service account, after clicking next you will need to choose the role to service account (this is optional but need to add to make it work). See this ibb.co/5RysC1B
    – bikram
    Aug 22, 2019 at 4:43
  • @Bikram Hi, Is 'Finance Permission' enough for get subscription data? (or) Need to give full permission?
    – DhineshYes
    Feb 1, 2020 at 7:10
  • @DhineshYes That would be enough I guess.
    – bikram
    Feb 1, 2020 at 13:14
  • This is gold! Thank you, worked like a charm. Otherwise I guess we would have to wait for 24hs Oct 16, 2021 at 19:56
36

If you followed all what @Bikram listed and you still facing the same error. Do this, create 'Managed product' temporary and then delete them. This way, sure you don't have to wait 24 hours.

It works for me.

7
  • 5
    This just literally saved me! I wish I could award this answer a bounty! Feb 29, 2020 at 20:39
  • OMG. I did not believe this would work, but it did. Thank you so much! Sep 24, 2020 at 4:58
  • Thank you! This works now on December 18, 2020.
    – unemployer
    Dec 18, 2020 at 1:19
  • That made the trick for me as well, thanks! :)
    – rgommezz
    Mar 18, 2021 at 19:57
  • 2
    Changing something in "Main store listing", such as your app title or description for the Play Store, also updates the permissions instantly rather than having to wait 24hrs+.
    – nating
    Jan 26, 2022 at 16:31
22

I faced a similar issue, the problem is in the settings we do in google developer project.

Refer to create-play-service-credentials for settings. Use the same primary account with which you created your in-app products.

Make sure you remove the previous one.

Link to a Google Developer Project Your Play Developer account needs to be linked to a Google Developer Project.

1a. Open the Settings > Developer account menus and select API access

API-access

1b. Select Link to connect your Play account to a Google Developer Project

choose-project-link

1c. Agree to the terms and conditions

agree-terms-conditions

2. Create Service Account Next we need to create a service account. This is done from the Google API Console.

2a. Select Create Service Account

create-service-account

2b. Create Service account key credentials

service-account

2c. Enter details for service account

enter-service-account-details

2d. Download your JSON credential: json-credentials

3. Grant Access

3a. In Play Console, select Grant Access on the newly created service account

grant-access

3b. Grant the following permissions:

apply-permissions

After granting access, Google takes 24-48 hours to propagate all access rights for all API's, till that time you'll continue to get the same error.

6
  • Do we first need to select add app to grant permission or not ? Here in 3b steps it is asking to Me to invite user on my service account email ? do we need to do that or we need to enter any valid gmail account email because when i go to grant access it shows me invite user ? Any help will be appreciated as stuck on this..
    – Jay Rathod
    Dec 11, 2020 at 12:31
  • For granting permissions to user you need to add the email and then set role as Editor, Admin etc. For grant permissions to app, you need to add that app first. Dec 12, 2020 at 5:57
  • But while i am granting permission it is taking email as service account id as last screen shot 3a in your answer so we should give it permission to that right ?
    – Jay Rathod
    Dec 14, 2020 at 6:35
  • 1
    Thanks for taking the effort to add screenshots. Google's systems are so ass backward and broken it is hard to know exactly which screen(s) you should be on otherwise.
    – Meekohi
    Apr 16, 2021 at 17:28
  • 2
    Adding the Financial permission to the service account did the trick (3b. Grant the following permissions)! Thank you very much!
    – RodneyRd
    Aug 31, 2022 at 20:53
17

After adding a new user in the Google Play Console, Google needs up to 24 hours to propagate all access rights for all apis.

I ran into the same issue, when I've tried to using the oauth2 flow to access the Inapp purchases status api. It's not official documented, but this github comment helped me to figure this out.

1
  • 1
    I'd been suffered hard for a whole day before I found this answer. THANKS a lot! This answer should be accepted as a right one!
    – ttmask
    Apr 29, 2019 at 9:52
7

Wait up to 24h OR create/edit any In-App product to force permission update,it takes 1-2 minutes to update and no need to wait 24h.

4

For someone who is facing this exact issue then the simple answer is to check the permissions to the service account which is linked in the Google Developer Console.

1.Open the Settings > Developer account menus and select API access 2.Choose the service account and check the permissions- REMEMBER FINANCE PERMISSION IS MUST FOR THIS ACTION

enter image description here

And after giving the permission update your subscription/package and make a new purchase then try again.

Happy Coding!

3

For my scenario:

If you are using service account to verify purchase via Google Play Developer API. Ensure you also click the View app information and download bulk reports (read only) permission besides the Financial data permissions.

enter image description here

After edited the permissions, update the in-app products and subscription (eg. change the descriptions).

Then wait for around 30 mins, the permission error gone. 🎉

2

I used service key and created it in Google APIs Credentials Cloud Platform, and I had the same issue until I added my created service key to Google Developer Console with all access.

I understood that you already created credentials in Google Developer Console, but maybe my experience will help someone else

1
  • 4
    I finally found that my email using for authentication need to be also granted permission on the Google play store project to use the API(s). Dec 9, 2017 at 5:25
0

For me the reason i had this issue because I did not check the permission to Release to production, exclude devices and use app signing by Google Play in Google Playstore console for the service account I created to manage app creation and management.

So check Users and Permission in the Google Play store console and check if the appropriate permission is checked.

0

It will automatically be fixed after 24 hrs, don't waster your time and energy with hacks, just wait and watch.

0

Unfortunately for me, I didn't find the answer anywhere. The error still appeared. My problem got resolved when I changed the scope to: https://www.googleapis.com/auth/androidpublisher. This gives the correct OAuth credentials. After changing the scope, I started using the "purchases.subscriptionsv2.get" method (url: https://androidpublisher.googleapis.com/androidpublisher/v3/applications/{packageName}/purchases/subscriptionsv2/tokens/{token}?access_token=your_access_token) instead of purchases.subscriptions.get (url:https://androidpublisher.googleapis.com/androidpublisher/v3/applications/{packageName}/purchases/subscriptions/{subscriptionId}/tokens/{token}?access_token=your_access_token) . It was somehow screwed up and now everything works! I hope I helped to someone

0

For those who are still trying to find exactly where the permissions have to be set, once you already configured all the other things, you can reach that section following these steps:

  1. log to https://play.google.com/console
  2. click on "Users and permissions", then click on the email address that corresponds to the service account (or click on "Manage" to the right of it)
  3. click on tab "Account permissions".

As explained from previous comments, you only need to check "View app information and download bulk reports (read only)" and "View financial data, orders and cancellation survery responses", even if that makes no sense at all. Then wait for some hours, because not always the permissions get refreshed, even after following all the other suggestions. In my case, I waited overnight.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.