Google-api-dotnet-client: AndroidPublisher.v3 Service Account auth not working

[nognomar]

Nuget: GoogleApis.AndroidPublisher.v3 1.40.2.1632

public class AndroidPublisherTest
{
    public AndroidPublisherTest(string packageName, string credentialsFile)
    {
        var credentials = GetCredentialsFromFile(credentialsFile);
        var service = new AndroidPublisherService(new BaseClientService.Initializer
        {
            HttpClientInitializer = credentials,
            ApplicationName = "Android publisher Test"
        });
        var edit = service.Edits.Insert(new AppEdit(), packageName).Execute();
        var apks = service.Edits.Bundles.List(packageName, edit.Id).Execute();
        foreach (var bundle in apks.Bundles)
        {
            Console.WriteLine($"Bundle version code: {bundle.VersionCode}");
        }
    }

    private static ServiceAccountCredential GetCredentialsFromFile(string credentialsFile)
    {
        if (!File.Exists(credentialsFile))
        {
            throw new FileNotFoundException(credentialsFile);
        }

        using (var stream = new FileStream(credentialsFile, FileMode.Open, FileAccess.Read))
        {
            var credentials = ServiceAccountCredential.FromServiceAccountData(stream);
            return credentials;
        }
    }
}

I getting this error:

Unhandled Exception: Google.GoogleApiException: Google.Apis.Requests.RequestError
Invalid Credentials [401]
Errors [
        Message[Invalid Credentials] Location[Authorization - header] Reason[authError] Domain[global]
]

But credentials are valid. I tested it with google-api-python-client and get the right bundles list.

[jskeet]

As an aside, a simpler way of loading the credentials is just GoogleCredential.FromFile(credentialsFile) but that wouldn't change the result on its own.

When you tested it with Python, was that on the same machine? If not, it's possible that there's a clock skew which is causing problems.
I note you're not using any scopes at at the moment - which should work using a JWT, but you might want try using credentials = credentials.CreateScoped(...) using the scopes in AndroidPublisherService.

[jskeet]

(Assigned to Chris as he knows more about auth than me - these were somewhat drive-by comments.)

[nognomar]

@jskeet yes i tested python client on the same machine.

With
var credentials = GoogleCredential.FromFile(credentialsFile).CreateScoped(new List<string> {AndroidPublisherService.Scope.Androidpublisher});
Everything is working fine! Thanks!

[jskeet]

Hooray - I guess the API just doesn't accept JWTs. Closing now.