Alex Rivera | Logout

Google Analytics API oauth exception "invalid_grant" with Service Account. Same code on two servers. Only one works

Asked 2012-08-15T16:25:59.687
9

I'm querying the Analytics API via a Service Account.

I have written the code on the dev server and it works without issues. When running the same code on the production server, it throws this:

Google_AuthException: Error refreshing the OAuth2 token, message: '{ "error" : "invalid_grant" }'

I've tried creating another Service account, and the behavior is the same.

The oAuth IETF draft (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-31) says this about the error:

     invalid_grant
           The provided authorization grant (e.g. authorization
           code, resource owner credentials) or refresh token is
           invalid, expired, revoked, does not match the redirection
           URI used in the authorization request, or was issued to
           another client.

Here is the code I've written:

$GA_CLIENT_ID = 'XX.apps.googleusercontent.com';
$GA_APP_EMAIL = 'XX@developer.gserviceaccount.com';
$GA_APP_NAME = 'XX';
$GA_KEY_FILE = 'XX';

// create client object and set app name
$client = new Google_Client();
$client->setApplicationName($GA_APP_NAME); // name of your app

// set assertion credentials
$client->setAssertionCredentials(
        new Google_AssertionCredentials(
            $GA_APP_EMAIL, // email you added to GA
            array('https://www.googleapis.com/auth/analytics.readonly'),
            file_get_contents($GA_KEY_FILE)  // keyfile you downloaded
            ));

// other settings
$client->setClientId($GA_CLIENT_ID);           // from API console
$client->setAccessType('offline_access');  // this may be unnecessary?

// create service and get data
$service = new Google_AnalyticsService($client);
$result = $service->data_ga->get($ids, $startDate, $endDate, $metrics, $optParams);
r
Edit
Report

1 Answer

24

Apparently the problem was the system time being off. Worked by sync-ing via NTP with:

sudo ntpdate npt.ubuntu.com

sudo ntpdate pool.ntp.org

Edit

As @RafaSashi suggested below, the pool.ntp.org server is more reliable. Use that instead of ntp.ubuntu.com (which was the first working one I tried, thus the initial choice).

answered 2012-08-16T00:30:10.647

Your Answer