Gmail Rest API:400 Bad Request + Failed Precondition

HttpError 400 Precondition check failed during users().messages().list Gmail API call using service account

I ran in to this as well when trying to list emails from my personal email. The Google dashboard set me up with service account credentials when enabling the Gmail API, so I assumed that was what I should use.

To make that 400 error go away, I had to add:

delegated_credentials = credentials.with_subject('my-email@gmail.com')

See https://developers.google.com/identity/protocols/oauth2/service-account#authorizingrequests.

 

However, I then got an error that my service account was unauthorized to make requests on behalf of my personal email. And if you're not using G Suite, I don't think there's a way to use a service account on behalf of a user.

So the ultimate solution to my problem was to use the OAuth authentication like in the Python Quickstart.

GMail API using Python Google API Client: error 400, failed precondition

What was missing, is one little piece mentioned in the documentation. In addition to setting the scopes, I need to impersonate a user account by calling with_subject:

cred = cred.with_subject(email)

After that it works as expected, hope that helps someone.

Sending email via Google API - Failed precondition

createDelegated(EMAIL_ADDRESS_CREATED_WHEN_CREATING_THE_SERVICE_ACCOUNT)

The email you should be setting this to is the email of the user on your workspace account that you have configured delegation for.

createDelegated("no-reply@Yourdomain.com")

Send should also be sent from the user on your domain. The way service accounts you preconfigure them to work impersonate a user on your domain. In this way the service account is pretending to be that user.

If you have not already read this: Perform Google Workspace Domain-Wide Delegation of Authority I can highly recommend doing so.

Faling precondition while using google Gmail api for Gsuite

In an attempt to help @Yeronimo hereby my answer (I hope it helps you):

Setting things up

This is the most important part of the implementation. It's important to understand that there is a huge difference between G suite account and a regular google account. You will need the administrator account of the G suite in order to set things up.

Step 1

!Important! Use the admin account of the google suite for all the steps!

Go to the google developers console and setup your project and api key's, this is what I did several times with no succes. But I did it correctly. This is what you can find everywhere.

• Create new project
• Create Serviceaccount
• etc..

Step 2

Go to the google G suite admin page and setup the rights for your G suite.

• Go to Api-rights (I have a dutch console -> so I just try to translate)
• Turn on the api's you want to use
• And trust internal apps

• Then go to advanced setting (This is stupidly hidden)
• There you can go to a page called something like: maintain api-client acces
• Go there
• Add the serviceaccount client id with the api endpoints you want to use

You can find the client id here: console.developers.google.com -> logins -> service account -> maintain service account -> options -> display client id.

I give you my screenshots so you can find it. I can't put the console on English.

Then copy that client id and use it. Also find the endpoint you need here.

Tip! See more detailed steps here

Using the code from the google documentation

Use the json or certificate file to authorize. It depends on which library you are using. I use the lib for c# so I had to use the certificate file. On creating credentials for your service account you can choose. Note that it can take a while before you can use the serviceaccount. I thought it was not working while 5 min later it suddenly did. It's annoying but when it's finally working it works like a charm.

If you need assistance with your code or something else ask me. I tried to answer as quick as possible. I hope this helps you.

---

Related Topics