Common Google Admin API Issues

“unauthorized_client” Error

If you encounter an error like this:

unauthorized_client: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.

This typically indicates that Domain-Wide Delegation is not properly configured for your service account.

Solution:

  1. Verify that you’ve completed the Domain-Wide Delegation setup as described in the Google Admin API setup guide.

  2. Double-check the following:

    • The Client ID used in Domain-Wide Delegation matches exactly with your service account’s Client ID
    • All required OAuth scopes are properly added
    • The admin email you’re using has Super Admin privileges in your Google Workspace
    • The admin email is correctly specified in your application configuration

  3. Common OAuth scopes needed for user operations:

    • https://www.googleapis.com/auth/admin.directory.user.readonly (for reading users)
    • https://www.googleapis.com/auth/admin.directory.user (for managing users)
    • https://www.googleapis.com/auth/admin.directory.group.readonly (for reading groups)
    • https://www.googleapis.com/auth/admin.directory.group (for managing groups)

API Access Issues

If you’re experiencing other API access issues:

  1. Ensure the Admin SDK API is enabled in your Google Cloud Console project
  2. Verify that your service account has the necessary IAM roles assigned
  3. Check that your credentials JSON file is correctly loaded in your application
  4. Confirm that the Google Workspace admin you’re using has the necessary privileges

Rate Limiting

Google Admin API has rate limits that may affect your application:

  • Daily quota: Typically 1,000,000 queries per day
  • Queries per 100 seconds per user: 1,500
  • Queries per 100 seconds per project: 6,000

If you’re hitting rate limits, consider implementing:

  • Exponential backoff for retries
  • Caching of frequently accessed data
  • Batch operations where possible

Testing Your Configuration

To verify your configuration is working correctly:

  1. Use the Google OAuth 2.0 Playground to test API access
  2. Try a simple API call to list users or groups
  3. Check the Google Cloud Console logs for any error messages