403 error "Not Authorized to access this resource/api" Google Admin SDK in web app even being admin
<p>I'm struggling to find the problem since two days without any idea why I get this error now even though the app was fully functional one month before.</p>

<p>Among the tasks done by the web app, it makes an Admin SDK API call to get the list of members of a group. The app has the scope <code>https://www.googleapis.com/auth/admin.directory.group.readonly</code>, but I get the 403 error "Not Authorized to access this resource/api" (I verified that the Admin SDK API was enabled in Google's Console).
By the way, the app had no problem to make a request to Google Classroom API before.</p>

<p>The most incredible thing here is that the app secrets have been generated by an admin account. And that I get this error when I log into the app with this same admin account. However, when I do tests with the documentation's (<a href="https://developers.google.com/admin-sdk/directory/v1/reference/members/list#response" rel="nofollow">https://developers.google.com/admin-sdk/directory/v1/reference/members/list#response</a>) I get a 200 response without a problem with exactly the same authorized scope.</p>

<p>Getting the list of members worked without a problem before with this admin account. Since then, nothing has changed in source code or in configuration so far as I know. So I think the problem may be related to the client secrets in some way, but I have no idea how.</p>

<p><strong>This web app will only be used by this admin account</strong></p>

<p>In my research on StackOverflow, I found most things talking about "Google Apps Domain-Wide Delegation of Authority" (<a href="https://developers.google.com/admin-sdk/directory/v1/guides/delegation" rel="nofollow">https://developers.google.com/admin-sdk/directory/v1/guides/delegation</a>), but I never used this when it worked before. And I would like to avoid this.</p>

<p>Do you have an idea why I get this 403 error with the web app even though it works when just testing the request in the documentation and I'm using a Super-Admin account ?</p>

<p><strong>Edit: I've now tested a simple snippet with "Google Apps Domain-Wide Delegation of Authority" based on this gist <a href="https://gist.github.com/MeLight/1f4517560a9761317d13ebb2cdc670d3" rel="nofollow">https://gist.github.com/MeLight/1f4517560a9761317d13ebb2cdc670d3</a> and the snippet alone works. 
However, when using it inside my app, I still get the 403 error. I'm getting insane, what could be the permission issue?</strong></p>

<p>Finally, after knocking my head against the wall, I found what was the problem:
the <code>groupKey</code> used to get the members of a group <code>https://www.googleapis.com/admin/directory/v1/groups/groupKey/members</code> had a <strong>trailing whitespace</strong>.</p>

<p>Yes, that's all. I just had to strip the string in the code (one line in Python) and it all went well.</p>

<p>All I did, searching for permissions / client ID / Delegation of Authority was for nuts it seems.</p>

<p>Seriously, the 403 error âNot Authorized to access this resource/apiâ of Google's API could have been more explicit.</p>

python web-applications google-api google-admin-sdk