Request had insufficient authentication scopes

[rajmani17234]

import os
import flask
import requests
from apiclient.discovery import build
import google.oauth2.credentials
import google_auth_oauthlib.flow
import googleapiclient.discovery

CLIENT_SECRETS_FILE = "/Users/rajm/Downloads/client_secret_107778277441-t2s9h0mkrh9f26s1988nag0e8b1mo3o2.apps.googleusercontent.com (7).json"

This OAuth 2.0 access scope allows for full read/write access to the

authenticated user's account and requires requests to use an SSL connection.

SCOPES = ['https://www.googleapis.com/auth/androidenterprise']
API_SERVICE_NAME = 'androidmanagement'
API_VERSION = 'v1'
CALLBACK_URL = 'https://storage.googleapis.com/android-management-quick-start/enterprise_signup_callback.html'
cloud_project_id = 'first-gcp-project-276615'

app = flask.Flask(name)

Note: A secret key is included in the sample so that it works.

If you use this code in your application, replace this with a truly secret

key. See https://flask.palletsprojects.com/quickstart/#sessions.

app.secret_key = os.urandom(16)

@app.route('/')
def index():
return print_index_table()

@app.route('/test')
def test_api_request():
if 'credentials' not in flask.session:
return flask.redirect('authorize')

Load credentials from the session.

credentials = google.oauth2.credentials.Credentials(
**flask.session['credentials'])

androidmanagement = build(
'androidmanagement', 'v1', credentials=credentials)

signup_url = androidmanagement.signupUrls().create(
projectId=cloud_project_id,
callbackUrl=CALLBACK_URL
).execute()

Save credentials back to session in case access token was refreshed.

ACTION ITEM: In a production app, you likely want to save these

credentials in a persistent database instead.

flask.session['credentials'] = credentials_to_dict(credentials)

return flask.jsonify(**signup_url)

@app.route('/authorize')
def authorize():

Create flow instance to manage the OAuth 2.0 Authorization Grant Flow steps.

flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file(
CLIENT_SECRETS_FILE, scopes=SCOPES)

The URI created here must exactly match one of the authorized redirect URIs

for the OAuth 2.0 client, which you configured in the API Console. If this

value doesn't match an authorized URI, you will get a 'redirect_uri_mismatch'

error.

flow.redirect_uri = flask.url_for('oauth2callback', _external=True)

authorization_url, state = flow.authorization_url(
# Enable offline access so that you can refresh an access token without
# re-prompting the user for permission. Recommended for web server apps.
access_type='offline',
# Enable incremental authorization. Recommended as a best practice.
include_granted_scopes='true')

Store the state so the callback can verify the auth server response.

flask.session['state'] = state

return flask.redirect(authorization_url)

@app.route('/oauth2callback')
def oauth2callback():

Specify the state when creating the flow in the callback so that it can

verified in the authorization server response.

state = flask.session['state']

flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file(
CLIENT_SECRETS_FILE, scopes=SCOPES, state=state)
flow.redirect_uri = flask.url_for('oauth2callback', _external=True)

Use the authorization server's response to fetch the OAuth 2.0 tokens.

authorization_response = flask.request.url
flow.fetch_token(authorization_response=authorization_response)

Store credentials in the session.

ACTION ITEM: In a production app, you likely want to save these

credentials in a persistent database instead.

credentials = flow.credentials
flask.session['credentials'] = credentials_to_dict(credentials)

return flask.redirect(flask.url_for('test_api_request'))

@app.route('/revoke')
def revoke():
if 'credentials' not in flask.session:
return ('You need to authorize before ' +
'testing the code to revoke credentials.')

credentials = google.oauth2.credentials.Credentials(
**flask.session['credentials'])

revoke = requests.post('https://oauth2.googleapis.com/revoke',
params={'token': credentials.token},
headers = {'content-type': 'application/x-www-form-urlencoded'})

status_code = getattr(revoke, 'status_code')
if status_code == 200:
return('Credentials successfully revoked.' + print_index_table())
else:
return('An error occurred.' + print_index_table())

@app.route('/clear')
def clear_credentials():
if 'credentials' in flask.session:
del flask.session['credentials']
return ('Credentials have been cleared.

' +
print_index_table())

def credentials_to_dict(credentials):
return {'token': credentials.token,
'refresh_token': credentials.refresh_token,
'token_uri': credentials.token_uri,
'client_id': credentials.client_id,
'client_secret': credentials.client_secret,
'scopes': credentials.scopes}

def print_index_table():
return ('

' +
'' +
'' +
'' +
'' +
'' +
'' +
'' +
'

Test an API request	Submit an API request and see a formatted JSON response. ' + ' Go through the authorization flow if there are no stored ' + ' credentials for the user.
Test the auth flow directly	Go directly to the authorization flow. If there are stored ' + ' credentials, you still might not be prompted to reauthorize ' + ' the application.
Revoke current credentials	Revoke the access token associated with the current user ' + ' session. After revoking credentials, if you go to the test ' + ' page, you should see an invalid_grant error.' + '
Clear Flask session credentials	Clear the access token currently stored in the user session. ' + ' After clearing the token, if you test the ' + ' API request again, you should go back to the auth flow.' + '

')

if name == 'main':

When running locally, disable OAuthlib's HTTPs verification.

ACTION ITEM for developers:

When running in production do not leave this option enabled.

os.environ['OAUTHLIB_INSECURE_TRANSPORT'] = '1'

Specify a hostname and port that are set as a valid redirect URI

for your API project in the Google API Console.

app.run('localhost', 8080, debug=True)

Upon executing this code in the terminal i'm facing this issue

googleapiclient.errors.HttpError: <HttpError 403 when requesting https://androidmanagement.googleapis.com/v1/signupUrls?projectId=first-gcp-project-276615&callbackUrl=https%3A%2F%2Fstorage.googleapis.com%2Fandroid-management-quick-start%2Fenterprise_signup_callback.html&alt=json returned "Request had insufficient authentication scopes.">

please do reply to this error on how can I solve it

Thanks in Advance

[busunkim96]

From the error message it looks like the credential you are using has insufficient scopes. Would you mind trying the suggestions here?