title: google oauth2 impersonate service account with user@gmail.com
body: <p>I wanted to access some google api services:</p>
  
  <ul>
  <li>GDrive API</li>
  <li>Contact API</li>
  <li>People API</li>
  </ul>
  
  <p>And I'm struggeling with the oauth2 impersonate service account flow (you know that one: <a href="https://developers.google.com/identity/protocols/OAuth2ServiceAccount" rel="nofollow">Google Oauth v2 - service account description</a>. For impersonification you need to apply the "Delegating domain-wide authority" in the google apps console, download the correspoding pk12 file and activate the api in a google console project.  </p>
  
  <p>At the moment I always get:</p>
  
  <pre><code>com.google.api.client.auth.oauth2.TokenResponseException: 401 Unauthorized
  at com.google.api.client.auth.oauth2.TokenResponseException.from(TokenResponseException.java:105)
  at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:287)
  at com.google.api.client.auth.oauth2.TokenRequest.execute(TokenRequest.java:307)
  at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.executeRefreshToken(GoogleCredential.java:384)
  at com.google.api.client.auth.oauth2.Credential.refreshToken(Credential.java:489)
  at oauthsample.GDriveAPI.&lt;init&gt;(GDriveAPI.java:50)
  at oauthsample.GDriveAPI.main(GDriveAPI.java:85)
  </code></pre>
  
  <p>Here is my code:</p>
  
  <pre><code>        HttpTransport httpTransport = new NetHttpTransport();
          JacksonFactory jsonFactory = new JacksonFactory();    
  
          Set&lt;String&gt; scopes = new HashSet&lt;String&gt;();
          scopes.add("https://www.google.com/m8/feeds");
  
          GoogleCredential credential = new GoogleCredential.Builder()
                  .setTransport(httpTransport)
                  .setJsonFactory(JSON_FACTORY)
                  .setServiceAccountId("myserviceuser@xxxxxx.iam.account.com")
                  .setServiceAccountPrivateKeyFromP12File(new File("somep12key.p12"))
                  .setServiceAccountScopes(scopes)
                  .setServiceAccountUser("my_user_name@gmail.com")
                  .build();
  
         credential.refreshToken();
         ContactsService service = new ContactsService("MYAPP");
          service.getRequestFactory().setHeader("User-Agent", "MYAPP");
          service.setHeader("GData-Version", "3.0");
          service.setOAuth2Credentials(credential);
  
          URL feedUrl = new URL("https://www.google.com/m8/feeds/contacts/default/full");
          ContactFeed resultFeed = service.getFeed(feedUrl, ContactFeed.class);
  </code></pre>
  
  <p>I also searched heavily through stackoverflow (can't list all references and checked the responses and solutions). But one question was never clearly answered - nor in googles documentaiont nor on all the stackoverflow posts:</p>
  
  <ul>
  <li><strong>Is it realy possible to impersonate a serviceaccount with a normal user@gmail.com user (I  mean a normal gmail account with no access to the mentioned admin console in the chapter "Delegating domain-wide authority to the service account" and withouth having a own domain )?</strong></li>
  </ul>
  
  <p>Some say yes, some say no. So what's the absolute truth?</p>
  
  <p>As far as I understand when reading the google docs: The service account can only impersonate on users when you in charge of a own domain and you need to have a google work account with your own domain registered. Then you're able to access the admin console and can grant access to the service account. </p>
  
  <p>Thanks for your patience and for your time to answer.</p>
  
  <p>Best regards
  Matt</p>