title: Can the Google Apps Script Execution API be called by a service account?
body: <p>I'd like to use a <a href="https://developers.google.com/identity/protocols/OAuth2ServiceAccount">service account</a> to access a Google Sheet via the Apps Script <a href="https://developers.google.com/apps-script/guides/rest/api">Execution API</a>, but it's not clear from the documentation whether this is supported.</p>
  
  <p>The steps I've tried (which result in a 403 status from the Execution API) are:</p>
  
  <ol>
  <li>Create a new (unbound) Apps Script</li>
  <li>Visit the linked Developer Console project</li>
  <li>Enable the Execution API</li>
  <li>Create a new service account within the same project (downloading 
  the generated JSON file)</li>
  <li>Create a new Google Sheet and share it with the service account's 
  email address (<strong>this is the step I'm least sure about</strong>)</li>
  <li>Write an apps script function that reads from the spreadsheet</li>
  <li>Run the script manually from the Script Editor (to set the scopes 
  on the script correctly)</li>
  <li>Publish the script ("Deploy as API executable"), making it accessible
  to 'anyone'</li>
  <li>Mint a new OAuth2 token using the service account and the scopes 
  linked to the script (in our case just 
  '<a href="https://www.googleapis.com/auth/spreadsheets">https://www.googleapis.com/auth/spreadsheets</a>')</li>
  <li>Attempt to make a call to the Execution API using the token</li>
  </ol>
  
  <p>This is the response I got:</p>
  
  <pre><code>{
    "error": {
      "code": 403,
      "message": "The caller does not have permission",
      "status": "PERMISSION_DENIED"
    }
  }
  </code></pre>
  
  <p>Does this not work because Service Accounts are never able to access the Execution API? Or is there something wrong with the steps above?</p>