title: Not Authorized To Access This Resource/API (GCP)
body: <p>I set up a service account with domain-wide delegation and I passed the client email, private key, scopes, and a user email the JWT method to impersonate a G-Suite user. I then get specific user info from the Admin API and use it to create an email signature and push it to the Gmail API. It works great if the user email I pass to the JWT method is a super admin but if I try to pass any other user I get an error response, &quot;Not Authorized to access this resource/api&quot;. Any ideas on how I can get it to work with a regular user account within my domain?</p>
  <p><strong>Here is the code. (genSignature.js)</strong></p>
  <pre><code>const { google } = require('googleapis');
  const privatekey = require('../private-key.json');
  
  const scopes = [
      'https://www.googleapis.com/auth/gmail.settings.basic',
      'https://www.googleapis.com/auth/gmail.settings.sharing', 
      'https://www.googleapis.com/auth/admin.directory.user', 
      'https://www.googleapis.com/auth/admin.directory.user.readonly'
  ];
  
  const auth = async (user) =&gt; {
      try {
          const jwtClient = new google.auth.JWT(
              privatekey.client_email,
              null, 
              privatekey.private_key,
              scopes,
              user // User who will be impersonated using the JWT client.
          );
  
          await jwtClient.authorize();
          return jwtClient;
  
      } catch (err) {
  
          console.log(err.message);
  
      };
  };
  
  function genSig(e) {
  
      auth(e).then((jwtClient) =&gt; {
  
          // Authenticate with the gmail API.
          const gmail = google.gmail({
              version: 'v1', 
              auth: jwtClient
          }); 
  
          // Authenticate with the admin API.
          const dir = google.admin({
              version: 'directory_v1', 
              auth: jwtClient
          });
  
  
          // Get users contact and job data from the directory. This data will be used as variables in their email signature. 
          dir.users.get({ userKey: e }, (err, response) =&gt; {
              if (err) {
                  console.log(err.message);
              } else {
                  let phones = response.data.phones;
                  let workPhone = '';
  
                  if (phones) {
                      for (i = 0; i &lt; phones.length; i++) {
                          if (phones[i].type == 'work') {
                              workPhone = phones[i].value;
                          };
                      };
                  };
  
                  function getUserData() {
                      let userData = {
                          name: response.data.name.fullName, 
                          email: response.data.primaryEmail, 
                          phone: workPhone, 
                          avatar: response.data.thumbnailPhotoUrl, 
                          department: response.data.organizations[0].department, 
                          title: response.data.organizations[0].title
                      }; 
                      return userData;
                  };
  
                  let requestBody = {
                      signature: 'Test' 
                  };
  
                  // Update the users email signature for their primary email.
                  gmail.users.settings.sendAs.update({ userId: e, sendAsEmail: e, requestBody }, (err, response) =&gt; {
                      if (err) {
                          console.log(err.message);
                      } else {
                          console.log(response.data);
                      };
                  });
              };
          });
      });
  }
  
  module.exports = genSig;
  </code></pre>
  <p><strong>(signatures.js)</strong></p>
  <pre><code>const express = require('express');
  const router = express.Router();
  const genSig = require('../../functions/genSignature');
  
  // Get webhooks from Google.
  router.post('/', (req, res) =&gt; {
  
      let email = req.body.email;
      let emailStr = email.toString();
      console.log(emailStr);
      genSig(emailStr);
  
  
      res.status(200).json({
          &quot;msg&quot;: &quot;data recieved...&quot;
      });
  });
  
  module.exports = router;
  </code></pre>
  <p><strong>(index.js)</strong></p>
  <pre><code>const express = require('express');
  const app = express();
  
  app.use(express.json());
  app.use('/email-signature', require('./routes/api/signatures'));
  
  const PORT = process.env.PORT || 6000;
  
  app.listen(PORT, () =&gt; console.log(`Server is running on port ${PORT}`));
  </code></pre>
  <p><strong>Here are some screenshots.</strong></p>
  <p><a href="https://i.stack.imgur.com/Pzx5P.png" rel="nofollow noreferrer">API configuration on G-Suite</a></p>
  <p><a href="https://i.stack.imgur.com/F7IzE.png" rel="nofollow noreferrer">Service Account Setup</a></p>
  <p><a href="https://i.stack.imgur.com/MwbWv.jpg" rel="nofollow noreferrer">Successful request vs unsuccessful request</a></p>