PHP Google Client API service account

Question

Im trying to connect with my App to Google Workspace to retrieve users and set im signature.

With normal oAuth2 app i can change signature only for me, not for other users (forbidden error) even that im logged as Admin, so I decided to change auth from oauth2 to service account:

In console.cloud.google.com I've created ServiceAccount and checked "Delegating domain-wide authority to the service account", generated JSON key and downloaded it.
In Admin Console (Google Workspace) in security > API section added ClientId from step#1.
Created script auth.php and uploaded to server on domain connected to Google Workspace:

require __DIR__ . '/vendor/autoload.php';
$redirect = 'DOMAIN/gapi/auth.php';
$credentials_file = "credentials_service_account.json"; //json key from step

$client = new Google_Client();
$client->setApplicationName("Some Random Name");
$client->setAuthConfig($credentials_file);

$client->setSubject('Admin_Email_In_Domain_In_Workspace');


$client->setScopes(["https://www.googleapis.com/auth/directory.readonly", "https://www.googleapis.com/auth/gmail.settings.basic", "https://www.googleapis.com/auth/gmail.settings.sharing"]);

$client->setAccessType("offline");
$client->setIncludeGrantedScopes(true);
$client->setRedirectUri($redirect);

$client->setApprovalPrompt('auto');

if (file_exists($tokenPath)) {
    $accessToken = json_decode(file_get_contents($tokenPath), true);
    $client->setAccessToken($accessToken);
}

if ($client->isAccessTokenExpired()) {
    if ($client->getRefreshToken()) {
        $client->fetchAccessTokenWithRefreshToken($client->getRefreshToken());
    } else {
        if (!isset($_GET['code'])) {
            $authUrl = $client->createAuthUrl();
            header("Location: $authUrl");
            exit;
        
        }else{
            $accessToken = $client->fetchAccessTokenWithAuthCode($_GET['code']);
            $client->setAccessToken($accessToken);
        
            if (array_key_exists('error', $accessToken)) {
                throw new Exception(join(', ', $accessToken));
            }
        
            if (!file_exists(dirname($tokenPath))) {
                mkdir(dirname($tokenPath), 0700, true);
            }
            file_put_contents($tokenPath, json_encode($client->getAccessToken()));
        }
    }
}

var_dump($client); //or whatever;

When i navigate in browser to this script i am redirected to google with error

Error 400: redirect_uri_mismatch

The redirect URI in the request, https://DOMAIN/gapi/auth.php, does not match the ones authorized for the OAuth client. To update the authorized redirect URIs, visit: https://console.developers.google.com/apis/credentials/oauthclient/${your_client_id}?project=${your_project_number}

I can't find in settings of Service Account to set up domains and redirect url just like in oAuth2. Also strange is that error has no your_client_id and your_project_numer only 'placeholders' for them.

PHP Google Client API service account

0 Answers