Unexpectedly got ACCESS_TOKEN_SCOPE_INSUFFICIENT response when making a request using the Google Chat API

Question

I'm working on a simple "bot" using the Google Chat API and I'm unable to send a message in a chat group.

In the Google Cloud Console I created a project, enabled the Google Chat API, generated OAuth credentials and in the OAuth consent screen I added this scope:
.../auth/chat

by manually entering:
https://www.googleapis.com/auth/chat

Then I downloaded the credentials from the Credentials section:
client_secret_XXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com.json

Locally I'm using a Google.py python wrapper around the google python modules, located here:
https://learndataanalysis.org/google-py-file-source-code/

I made a slight change in this file to use console authentication instead of browser:
flow.run_local_server() -> flow.run_console()

My code looks like this:

from Google import Create_Service

CLIENT_SECRET_FILE = 'client_secret_XXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com.json'
API_NAME = 'chat'
API_VERSION = 'v1'
SCOPES = ['https://www.googleapis.com/auth/chat']

service = Create_Service(CLIENT_SECRET_FILE, API_NAME, API_VERSION, SCOPES)

text = 'My message'

space = 'spaces/XXXXXXXXXX'

chat_metadata = {
    'text': text,
}

service.spaces().messages().create(parent=space, body=chat_metadata).execute()

The Create_Service call guides me through a console authorization, eg:

Please visit this URL to authorize this application: https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=...
Enter the authorization code:

After I visit the link, I receive a token, which I enter in the console and I get this Python error:

googleapiclient.errors.HttpError: <HttpError 403 when requesting https://chat.googleapis.com/v1/spaces/XXXXXXX/messages?alt=json returned "Request had insufficient authentication scopes.". Details: "[{'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'ACCESS_TOKEN_SCOPE_INSUFFICIENT', 'domain': 'googleapis.com', 'metadata': {'service': 'chat.googleapis.com', 'method': 'google.chat.v1.ChatService.CreateMessage'}}]">

Apparently I supplied the chat scope with the request and also, as I mentioned, I made sure it is added to the OAuth consent screen. I couldn't find any other chat scopes. Is there some other step I'm missing or are there any other scopes, which I should use for creating messages?

BTW, because I noticed that in the Google Cloud Console this scope's description is "View and manage chat conversations and user state" and doesn't explicitly mention "creating", I tried other calls like: service.spaces().get(), or service.spaces().members().list(). However I still got the same error.

I should also mention that the same approach works fine with the Google Drive API for creating files, folders, creating permissions, etc.

I appreciate any help with this.

Answer 1

Always check the documentation for the method it will tell you what scope of permissions it needs.

In this case Method: spaces.messages.create needs the following scope.

Which is not the one you are using.