Not authorized to request the scopes - Google OAuth2 for devices

Question

I've recently been working on accessing the gmail API from a python script.

As the script needs to run on a server, without any form of web browser, I've had to implement the OAuth for Devices flow, as detailed at https://developers.google.com/accounts/docs/OAuth2ForDevices

This has gone just fine, as I've been testing with the "profile" scope, I've been getting access tokens as expected.

However, to switch over to the the actual token that my script needs, as I need to be authorised to write to the user's email, I've tried running my script with the scope www.googleapis.com/auth/gmail.compose, which returns the following:

{u'error_uri': u'code.google.com/apis/accounts/docs/OAuth2.html', u'error_description': u'Not authorized to request the scopes: [www.googleapis.com/auth/gmail.compose]', u'error': u'invalid_scope'}

At this point I got curious, and tried a variety of scopes, it seems fairly arbitrary to me, which ones would, and would not work.

Working:

www.googleapis.com/auth/calendar
www.google.com/m8/feeds

Not working:

mail.google.com/
www.googleapis.com/auth/gmail.compose
www.googleapis.com/auth/gmail.readonly
www.googleapis.com/auth/gmail.modify
www.googleapis.com/auth/contacts.readonly

I've uploaded my code to https://gist.github.com/Hanse00/3a861430b1543599b3ed for anyone interested in having a look.

The Gmail API is indeed enabled in the project console.

If anyone has any clue why this would be happening, I'd be glad to hear from you!

Note: I've had to edit the scopes as they count as links, and my reputation is not high enough to post them all. The scopes I tried were in fact the correct ones.

Answer 1

The Oauth2 for devices flow is less secure and is fine/allowed for some less-sensitive APIs however not all of them. The Gmail API does not allow using it.

You could have your server implement the web server flow (if you can run an http server on it) and then your client will redirect back there with a proper token you can retrieve+store: https://developers.google.com/accounts/docs/OAuth2WebServer