I’m trying to use the API with my default app creds like this:

client = AnalyticsAdminServiceClient()

resource = 'accounts/YOUR_ACCOUNT_ID'
email = '[email protected]'
role = 'roles/editor'

access_binding = AccessBinding(
    role=role,
    email_address=email
)

request = CreateAccessBindingRequest(
    parent=resource,
    access_binding=access_binding
)

response = client.create_access_binding(request=request)

I am an admin and can do everything in the UI.

But when I run this script I get:

google.api_core.exceptions.PermissionDenied: 403 Request had insufficient authentication scopes. [reason: "ACCESS_TOKEN_SCOPE_INSUFFICIENT"
domain: "googleapis.com"
metadata {
  key: "service"
  value: "analyticsadmin.googleapis.com"
}
metadata {
  key: "method"
  value: "google.analytics.admin.v1alpha.AnalyticsAdminService.CreateAccessBinding"
}

So I tried to build the client like this and got the same error:

scopes = [
    "https://www.googleapis.com/auth/cloud-platform",
    "https://www.googleapis.com/auth/analytics.edit",
    "https://www.googleapis.com/auth/analytics.manage.users",
]
default_creds = google.auth.default(scopes=scopes)[0]
client = AnalyticsAdminServiceClient(transport=transport, credentials=default_creds)

Then I tried updating my default app creds like this and got the same error:

gcloud auth application-default login --scopes=openid,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/analytics.edit

I tried adding the scope “https://www.googleapis.com/auth/analytics.manage.users” to the gcloud command, but when I login it says the app was block because it was trying to access sensitive data.

Are service accounts the only way to do this with the SDK? Everything else has works with default app creds for me until now.