Gradle-play-publisher: 401 Unauthorized

[nscherer]

I set up a service account, it seems to be linked appropriately (though if there are steps to verify that I'd be happy to) and I gave it project -> edit permissions. I downloaded the json key file and configured it:

    playAccountConfigs {
        defaultAccountConfig {
            jsonFile = file('Google Play Android Developer-bd451789a4fa.json')
        }
    }

The information in the json file matches what's on the web console. When running a bootstrap task I get this;

-------------- REQUEST  --------------
POST https://www.googleapis.com/androidpublisher/v2/applications/com.redshedtechnology.chicagotitleadvantage/edits
Accept-Encoding: gzip
Authorization: <Not Logged>
User-Agent: gradle-play-publisher Google-API-Java-Client Google-HTTP-Java-Client/1.22.0 (gzip)
Content-Encoding: gzip
Content-Length: 20

curl -v --compressed -X POST -H 'Accept-Encoding: gzip' -H 'Authorization: <Not Logged>' -H 'User-Agent: gradle-play-pub
lisher Google-API-Java-Client Google-HTTP-Java-Client/1.22.0 (gzip)' -H 'Content-Encoding: gzip' -d '@-' -- 'https://www
.googleapis.com/androidpublisher/v2/applications/com.redshedtechnology.chicagotitleadvantage/edits' << $$$
-------------- RESPONSE --------------
HTTP/1.1 401 Unauthorized
Transfer-Encoding: chunked
Alt-Svc: quic=":443"; ma=2592000; v="38,37,36,35"
Server: GSE
X-Content-Type-Options: nosniff
WWW-Authenticate: Bearer realm="https://accounts.google.com/", error=invalid_token
Date: Mon, 05 Jun 2017 15:11:01 GMT
X-Frame-Options: SAMEORIGIN
Cache-Control: private, max-age=0
Content-Encoding: gzip
Vary: X-Origin
Vary: Origin
Expires: Mon, 05 Jun 2017 15:11:01 GMT
X-XSS-Protection: 1; mode=block
Content-Type: application/json; charset=UTF-8

Highlights: HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="https://accounts.google.com/", error=invalid_token

I don't know if it's related but I haven't seen anything in the documentation about how to map flavors to apps, because each flavor in my build file corresponds to a different application in the play store. Maybe this plugin doesn't support that?

[ShreyashPromact]

I am also facing the same issue.
Can anyone help me to resolve this issue?

Thanks.
Sincerely,
Shreyash

[Xianic]

I have the same issue as @nscherer describes. I'm using a JSON key files as above. Gradle appears to be able to request successfully request an OAuth2 token (response 200), and then fails to POST to https://www.googleapis.com/androidpublisher/v2//edits (response 401).

The target executed was bootstrapReleasePlayResources.

Any help will be appreciated,
Thanks,
Xian

[nicolasazrak]

In my case the problem was not giving enough permissions to the service account in google play console (which is different than google cloud IAM). Going from the google play console account (not from the application) to settings -> Developer Account -> Users & Permissions I could grant access to the account.

[nscherer]

Nicolas, can you elaborate? I followed your instructions but I don't know which of several users to update. If I go to Developer account -> API access I see the service account I created. If I click the Grant Access button the permissions look fine. But I don't see any connection between the service account and any of the users. Did you set up the plugin to use a service account, or some other way? My build file refers to a JSON file with details about the service account such as the project id, private key, and client id.

[nicolasazrak]

Just update the account the key.json refers (search by email, in may case was automatically generated and looks like account-name@api-******.iam.gserviceaccount.com). In my case I created a new account, downloaded the json key from google cloud console belonging to that account and changed my build file to use that json.

[nscherer]

That's exactly the process I followed to create and use a service account,
but you mentioned editing permissions on a user, which is different. Does
your JSON file point to a service account, or a user? My understanding is
the recommended way to grant this access is via a service account.

[nicolasazrak]

Sorry if I expressed myself wrong, I used a service_account, but after giving it access it shows up as another user under "Users & Permissions". If you followed the same process maybe you have a different problem.

[nscherer]

I see, the service account I created doesn't show up user Users &
permissions.

[AndroidGecko]

@nscherer
So to solve this

1. Create service account -> but set no roles there (big dropdown)
2. copy the json or .p12 file
3. copy email for this service account
4. Go to Google Dev Console -> Users&Permissions
5. Invite new user -> paste service email
6. set roles as in repo description
7. setup other things in gradle file as per repo description
8. should work

[nscherer]

@AndroidGecko perfect, that solved the 401 error - thank you. Now I'm getting a different error, not sure if I should report it separately.

Error:Execution failed for task ':app:bootstrapAppNamePlayResources'. java.io.IOException: Invalid PKCS8 data.

Stack trace:

Caused by: java.io.IOException: Invalid PKCS8 data.
        at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.privateKeyFromPkcs8(GoogleCredential.java:812)
        at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.fromStreamServiceAccount(GoogleCredential.java:788)
        at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.fromStream(GoogleCredential.java:260)
        at com.google.api.client.googleapis.auth.oauth2.GoogleCredential$fromStream.call(Unknown Source)
        at de.triplet.gradle.play.AndroidPublisherHelper.authorizeWithServiceAccount(AndroidPublisherHelper.groovy:66)
        at de.triplet.gradle.play.AndroidPublisherHelper.authorizeWithServiceAccount(AndroidPublisherHelper.groovy:45)
        at de.triplet.gradle.play.AndroidPublisherHelper.init(AndroidPublisherHelper.groovy:86)
        at de.triplet.gradle.play.PlayPublishTask.publish(PlayPublishTask.groovy:28)
        at de.triplet.gradle.play.PlayPublishTask$publish.callCurrent(Unknown Source)
        at de.triplet.gradle.play.BootstrapTask.bootstrap(BootstrapTask.groovy:26)
        at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:73)

The last few lines of output before the error:

Executing task ':app:bootstrapPropertyForceDemoLegacyReleasePlayResources' (up-to-date check took 0.0 secs) due to:
  Task has not declared any outputs.
:app:bootstrapAppNamePlayResources FAILED
:app:bootstrapAppNamePlayResources (Thread[Daemon worker,5,main]) completed. Took 0.663 secs.

I guess this has something to do with the credentials in the json file, or the p12 file, but I don't know how to diagnose the problem.

[SUPERCILEX]

Looks like this was due to a misconfigured service account. @nscherer If you're still experiencing that PKCS error, feel free to file a new issue.