I have successfully fetched data, updated, and uploaded extensions using OAuth 2.0 client access for Google APIs. However, I now need to update a Chrome extension automatically. To achieve this, I need to use a service account to ensure that the tokens and refresh tokens do not expire, thus avoiding the need for authorization via a consent screen. Despite my efforts, I consistently encounter a 403 Forbidden error, indicating that I don’t have the appropriate service account permissions.

Does anyone know how to accomplish this or if it’s even possible to perform this task with a service account? Alternatively, is it mandatory to use client OAuth credentials for this process?

Thank you in advance for your help.

Here is my current code: (The result is a 403 Forbidden error, which suggests that I lack the necessary service account permissions.)

from google.oauth2 import service_account
import datetime
import jwt  # PyJWT library
import requests

SERVICE_ACCOUNT_FILE = 'service_account_new.json'
AUDIENCE = 'https://oauth2.googleapis.com/token'
EXTENSION_ID = 'extension-id'

def get_jwt():
    # Load the service account info
    credentials = service_account.Credentials.from_service_account_file(SERVICE_ACCOUNT_FILE)

    # Create a JWT token
    now = datetime.datetime.utcnow()
    payload = {
        'iss': credentials.service_account_email,
        'scope': 'https://www.googleapis.com/auth/chromewebstore',
        'aud': AUDIENCE,
        'iat': now,
        'exp': now + datetime.timedelta(hours=1)  # Token valid for 1 hour,
    }


    # Sign the JWT with the service account's private key
    signed_jwt = jwt.encode(payload, credentials.signer._key, algorithm='RS256')

    return signed_jwt

def get_token(signed_jwt):
    url = 'https://oauth2.googleapis.com/token'
    payload = {
        'grant_type': 'urn:ietf:params:oauth:grant-type:jwt-bearer',
        'assertion': signed_jwt
    }

    # Make the POST request
    response = requests.post(url, data=payload)

    # Print the response
    return response.json().get('access_token')

def get_extension_item(token, extension_id):
    url = f'https://www.googleapis.com/chromewebstore/v1.1/items/{extension_id}?projection=DRAFT'

    headers = {
        'Authorization': f'Bearer {token}',
        'Content-Type': 'application/json'
    }

    response = requests.get(url, headers=headers)

    if response.status_code == 200:
        data = response.json()
        print(data)
    else:
        print(f"Failed to fetch extension details. Status code: {response.status_code}")
        print(response.text)  # Print the error response for debugging purposes


def main():
    signed_jwt = get_jwt()
    token = get_token(signed_jwt)
    get_extension_item(token, EXTENSION_ID)

if __name__ == '__main__':
    main()