title: "Access Denied. Provided scope(s) are not authorized" error when trying to make objects public using the REST API
body: <p>I am attempting to set permissions on individual objects in a Google Cloud Storage bucket to make them publicly viewable, following <a href="https://cloud.google.com/storage/docs/access-control/making-data-public" rel="nofollow noreferrer">the steps indicated in Google's documentation</a>. When I try to make these requests using our application service account, it fails with HTTP status <code>403</code> and the following message: </p>
  
  <blockquote>
    <p>Access denied. Provided scope(s) are not authorized. </p>
  </blockquote>
  
  <p>Other requests work fine. When I try to do the same thing but by providing a token for my personal account, the <code>PUT</code> request to the object's ACL works... about 50% of the time (the rest of the time it is a <code>503</code> error, which may or may not be related). </p>
  
  <p>Changing the IAM policy for the service account to match mine - it normally has Storage Admin and some other incidental roles - doesn't help, even if I give it the overall Owner IAM role, which is what I have.</p>
  
  <p>Using neither the <code>XML</code> API nor the <code>JSON</code> version makes a difference. That the request sometimes works with my personal credentials indicates to me that the request is not incorrectly formed, but there must be something else I've thus far overlooked. Any ideas?</p>