Google-api-ruby-client: invalid_grant error

[lessless]

Hello! Today I've faced an invalid grant error, and as I'm doing a service application I'm confused because there should not be any refresh tokens, only access tokens, right? https://developers.google.com/accounts/docs/OAuth2ServiceAccount

WARN -- : Google::APIClient - Please provide :application_name and :application_version when initializing the client
/home/lessless/.rvm/gems/ruby-2.0.0-p247/gems/signet-0.4.5/lib/signet/oauth_2/client.rb:873:in `fetch_access_token': Authorization failed.  Server message: (Signet::AuthorizationError)
{
  "error" : "invalid_grant"
}
    from /home/lessless/.rvm/gems/ruby-2.0.0-p247/gems/signet-0.4.5/lib/signet/oauth_2/client.rb:888:in `fetch_access_token!'
    from /home/lessless/projects/repaker/generator/_plugins/lib/google_client.rb:23:in `fetch_api_token!'
    from /home/lessless/projects/repaker/generator/_plugins/lib/google_client.rb:8:in `initialize'

here is my code

  class GoogleClient
    attr_reader :credentials, :client

    def initialize(credentials)
      @credentials = credentials
      @client = Google::APIClient.new()
      fetch_api_token!
    end


    def fetch_api_token!
      # Load our credentials for the service account
      key = Google::APIClient::KeyUtils.load_from_pkcs12(credentials['key_file'], credentials['key_secret'])
      @client.authorization = Signet::OAuth2::Client.new(
        :token_credential_uri => 'https://accounts.google.com/o/oauth2/token',
        :audience => 'https://accounts.google.com/o/oauth2/token',
        :scope => 'https://www.googleapis.com/auth/analytics.readonly',
        :issuer => credentials['service_account_email'],
        :signing_key => key)

      # Request a token for our service account
      @client.authorization.fetch_access_token!      
    end    

  end

also time is synced with ntp: sudo ntpdate ntp.ubuntu.com
as https://developers.google.com/analytics/devguides/reporting/core/v2/gdataAuthentication suggests

[gboruk]

Hello, did you ever get this resolved? I'm running into the same issue.

[andreitr]

I had the same issue... As it turns out the clock on my local computer was a bit ahead... Once I updated the clock and restarted the server everything worked.

[RoryMacDonald]

I had the same issue and updating the clock resolved it. I was running my app within Vagrant, which was out of sync with UTC time.

[ttanimichi]

I had the same issue.

[rocky-jaiswal]

Faced this myself as well. Every now and then, we get this or some other error (like a nil response) when calling adwords_api.authorize, this seems to go away when we do a server restart.

[nsanta]

Same issue here.

[abi1703]

Hi I am also having the same error. With which clock i should sync my local desktop. I am running it from my desktop No other servers involved.please help.

[spalenza]

Same issue here.

[danielchangNYC]

+1

[spalenza]

I solved my problem with this code.

require 'google/api_client'

account_email = EMAIL_ADDRESS
key_file = PATH_OF_PRIVATEKEY.p12
key_secret = 'notasecret'
client = Google::APIClient.new

key = Google::APIClient::KeyUtils.load_from_pkcs12(key_file, key_secret)

 client.authorization = Signet::OAuth2::Client.new(
   :token_credential_uri => 'https://accounts.google.com/o/oauth2/token',
   :audience => 'https://accounts.google.com/o/oauth2/token',
   :scope => 'https://www.googleapis.com/auth/content',
   :issuer => account_email,
   :signing_key => key)

 client.authorization.fetch_access_token!
 service = client.discovered_api('content', 'v2')

Above exemple I discovered google shopping API.

[palfvin]

And yet another +1 here

[jaketlarson]

+1

[smarquezs]

I solved my issue running sudo ntpdate ntp.ubuntu.com inside vagrant machine
And here is my code:

class GoogleClientService
  def initialize(scope, key_file)
    @scope    = scope
    @key_file = key_file
  end

  def get_access_token
    client = Google::APIClient.new(application_name: 'app_name')
    key    = Google::APIClient::KeyUtils.load_from_pkcs12(@key_file, 'notasecret')

    client.authorization = Signet::OAuth2::Client.new(
      token_credential_uri: ENV['TOKEN_URI'],
      audience:             ENV['TOKEN_URI'],
      scope:                @scope,
      issuer:               ENV['SERVICE_ACCOUNT_EMAIL'],
      signing_key:          key
    )

    client.authorization.fetch_access_token!
  end

end

[pacuna]

solution from @smarquezs solved the issue for me.

[thiagoxvo]

:+1: @smarquezs same solution here, thanks!!

[nasaabg]

@smarquezs same solutoin, good job!

[adityamajeti]

hi @smarquezs

i followed your code, but i am getting error WARN: Authorization failed. Server message: {"error" : "invalid_grant"}, plz help me!

is project name and application name are same

require "google/api_client"

@account_email = "[email protected]"
@key_file = "pcskudos-xxxxxxxxx.p12"

client = Google::APIClient.new(application_name: 'pcskudos')
key    = Google::APIClient::KeyUtils.load_from_pkcs12(@key_file, 'notasecret')

client.authorization = Signet::OAuth2::Client.new(
  token_credential_uri: 'https://accounts.google.com/o/oauth2/token',
  audience:             'https://accounts.google.com/o/oauth2/token',
  scope:                @scope,
  issuer:               @account_email,
  signing_key:          key
)

client.authorization.fetch_access_token!
puts client.authorization.fetch_access_token

[nasaabg]

Have you tried to run sudo ntpdate ntp.ubuntu.com ?

[adityamajeti]

yes i tried

[adityamajeti]

I need to access spreadsheet which is drive of my mail. is any other process

[rafath]

I've spent 2,5 hours searching for solution, on localhost everything was fine, but on server it didn't work...
and after runing _sudo ntpdate ntp.ubuntu.com_ everything was fine... thanks

[omarojo]

What is this.. Im not using ubuntu. Im using MacOSX and also iOS in both platforms Im able to get new access tokens, using the refresh token. The problem is that after some hours.. specially after the access token expired, I try to get a new one... then I get the invalid_grant response. I dont know why it works perfectly.. but soon after the access_token expires... the refresh_token is not able to get more access_tokens.

[tvcam]

+1 for sudo ntpdate ntp.ubuntu.com

[jahrichie]

OS X running latest Ruby, is this dead?

[amrutjadhav]

I was suffering from same problem. But after resetting clock on my laptop, It worked.

[tacnoman]

I had this problem with Mac Os X. My date and time was wrong. I fixed this and the problem was solved.

[MohdAnas]

I am using this code

````
require 'google/api_client'

account_email = EMAIL_ADDRESS
key_file = PATH_OF_PRIVATEKEY.p12
key_secret = 'notasecret'
client = Google::APIClient.new

key = Google::APIClient::KeyUtils.load_from_pkcs12(key_file, key_secret)

client.authorization = Signet::OAuth2::Client.new(
:token_credential_uri => 'https://accounts.google.com/o/oauth2/token',
:audience => 'https://accounts.google.com/o/oauth2/token',
:scope => 'https://www.googleapis.com/auth/content',
:issuer => account_email,
:signing_key => key)

client.authorization.fetch_access_token!
service = client.discovered_api('content', 'v2')
````

I am able to get the access token but when I hit the reseller API for site verification I am getting the following error

`(byebug) site_verification = Google::Apis::SiteVerificationV1::SiteVerificationService.new
*** NameError Exception: uninitialized constant Google::Apis

nil
`

[sqrrrl]

@MohdAnas - Looks like you're mixing versions of the client library. The initial block is using the older 0.8.x version, the 2nd block looks like 0.9.x

[alexismansilla]

If your case is dinghy, you should restart proxy container

$ dinghy restart