Can't send test messsage to Pub/Sub Topic with Google Workspace Account

[JPsotka]

Hello, I created a simple Go Application that starts Push Notifications from Gmail to Cloud Pub/Sub with the watch method. That works totally fine for my personal google Account but when I try the same with my Google Workspace Account from my company I get the following error:

googleapi: Error 403: Error sending test message to Cloud PubSub projects/clickup-ticket-creator/topics/gmail-messages : User not authorized to perform this action., forbidden

I set up bot GCP Projects in the totally same manner, bot grant the ".../auth/gmail.readonly" API Scope at the oauth consent screen and use an OAuth2 Key. The only difference is that the OAuth Consent Srceen is set to internal for the one in the workspace account, I already tried switching the usage type to external and adding the User i use to the allowed users but this also won't work.
I'm out of ideas.

[ms4446]

Here are some steps to troubleshoot and potentially resolve the issue:

1. Double-Check Permissions:

   • Pub/Sub Permissions:

     • Ensure the Google Workspace user account you're using has the Pub/Sub Publisher role on the specific topic (gmail-messages) within your project (clickup-ticket-creator).
     • Navigate to your Pub/Sub topics list in the Google Cloud Console: Google Cloud Pub/Sub Console.
     • Select your topic, go to "Permissions," and verify or grant the required role.

   • Gmail API Permissions:

     • Confirm that the Gmail API is enabled in your Google Cloud Project. Go to APIs & Services -> Library and search for "Gmail API."
     • Verify that the OAuth client ID you're using has the correct scope (https://www.googleapis.com/auth/gmail.readonly) and is authorized for the Google Workspace domain.

   • Service Account (if applicable):

     • If your Go application is using a service account, make sure it also has the Pub/Sub Publisher role and the necessary Gmail API permissions.

2. OAuth Consent Screen:

   • Internal vs. External: While you've tried switching, try it again just in case:

     • Internal: Typically for apps only used within your organization. If this is the case, ensure the user you're testing with is explicitly added to the list of allowed users in the consent screen.
     • External: If your application might be used outside your organization, choose this. However, Google Workspace admins might need to pre-approve the app.

   • Verification Status: If your app is still in testing, it may be unverified. You might need to request verification from Google, especially for external apps.

3. Google Workspace Admin Settings:

   • API Access: Some organizations restrict API access. Check with your Google Workspace admin to ensure that the Gmail API and Pub/Sub API are allowed for your account or user group.
   • Domain-Wide Delegation: If you need the application to act on behalf of other users in the domain, you might require domain-wide delegation of authority. Your Workspace admin can set this up.

4. Go Application Code Review:

   • Authentication: Thoroughly review how your Go application is handling OAuth2 authentication. Make sure it's refreshing tokens if needed and properly catching authentication errors.
   • Error Handling: Enhance your code to log more detailed error messages from the Gmail API and Pub/Sub API. This can provide valuable clues about what's going wrong.

5. Additional Tips:

   • Push Notifications Scope: While https://www.googleapis.com/auth/gmail.readonly is sufficient for reading emails, if your application needs to create push notifications for new emails, you might need the https://www.googleapis.com/auth/gmail.modify scope.
   • Firewall Rules: If your application runs on a server with a firewall, ensure it allows outgoing connections to Google Cloud Pub/Sub endpoints.

Below is a conceptual snippet in Go for using the Gmail API to watch for changes:

srv, err := gmail.NewService(ctx, option.WithCredentials(creds))
if err != nil {
    // Handle error
}

watchRequest := &gmail.WatchRequest{
    TopicName: "projects/your-project/topics/your-topic",
    LabelIds: []string{"INBOX"}, // Or specific label IDs
}

_, err = srv.Users.Watch("me", watchRequest).Do()
if err != nil {
    // Handle error (look for 403 in the error message)
}