Google+ Domains API via service account fails with 403 Forbidden

Question

I have a simple Ruby code that I combined from several examples. It uses Google+ Domain API. I followed all steps to authorize a service account (https://developers.google.com/+/domains/authentication/delegation), but my requests fail with 403 Forbidden:

{"error"=>{"errors"=>[
{"domain"=>"global", "reason"=>"forbidden", "message"=>"Forbidden"}], 
"code"=>403, "message"=>"Forbidden"}}

The same queries work fine if I execute them using Google APIs Explorer console. I think it's related to the service account vs. user account authentication. What did I miss?

The full code is here https://github.com/admitriyev/propellant/blob/master/main.rb

[edited] I added an installed app flow into the same code, and it worked fine (full code is on Gihub above). I still don't know what I missed in the service flow though.

Answer 1

I figured it out, I was missing the email of the actual domain user on behalf of whom it should be authorized. I also switched to use Google::APIClient::JWTAsserter which is a cleaner abstraction:

client_asserter = Google::APIClient::JWTAsserter.new(
  config['client_email'],
  PLUS_LOGIN_SCOPE,
  key
)
$client.authorization = client_asserter.authorize(config['user_email'])

My full example is here: https://github.com/admitriyev/propellant/blob/master/main.rb