title: Getting AppEngine AppAssertionCredentials working (Python)?
body: <p>I am updating an App Engine python project from the old Google Admin SDK API to the new one and having difficulty getting the <a href="https://developers.google.com/api-client-library/python/guide/google_app_engine#ServiceAccounts" rel="nofollow">built in services account</a> (<a href="http://google-api-python-client.googlecode.com/hg/docs/epy/oauth2client.appengine.AppAssertionCredentials-class.html" rel="nofollow">AppAssertionCredentials</a>)authenticated.</p>
  
  <p>I have already</p>
  
  <ul>
  <li>Enabled the Admin SDK API in the Developers console</li>
  <li>Enabled API access in the Google Apps dashboard</li>
  </ul>
  
  <p>To work around this I created a service account from the Developers console, downloaded the credentials.json, and set the following permissions (without quotes) in the Google Apps dashboard (Security > Advanced settings > Manage API client access) for that account:</p>
  
  <ul>
  <li>client: "{ service account id }.apps.googleusercontent.com" </li>
  <li>permissions:  "<a href="https://www.googleapis.com/auth/admin.directory.user.readonly" rel="nofollow">https://www.googleapis.com/auth/admin.directory.user.readonly</a> <a href="https://www.googleapis.com/auth/admin.directory.group.readonly" rel="nofollow">https://www.googleapis.com/auth/admin.directory.group.readonly</a> <a href="https://www.googleapis.com/auth/admin.directory.group.member.readonly" rel="nofollow">https://www.googleapis.com/auth/admin.directory.group.member.readonly</a>"</li>
  </ul>
  
  <p>My current code is (redacted slightly)</p>
  
  <pre><code># ...
  
  import json
  from google.appengine.api import memcache
  from googleapiclient.discovery import build
  from httplib2 import Http
  from oauth2client.client import SignedJwtAssertionCredentials
  
  GAPPS_CREDENTIALS = 'credentials.json'
  GAPPS_SCOPES = [
    'https://www.googleapis.com/auth/admin.directory.user.readonly',
    'https://www.googleapis.com/auth/admin.directory.group.readonly',
    'https://www.googleapis.com/auth/admin.directory.group.member.readonly'
  ]
  GAPPS_ADMIN = 'admin'
  GAPPS_DOMAIN = 'domain.com'
  GAPPS_USER = 'user'
  
  # ...
  
  with open(GAPPS_CREDENTIALS) as jsonfile:
    jsondata = json.load(jsonfile)
    credentials = SignedJwtAssertionCredentials(
      jsondata['client_email'],
      jsondata['private_key'],
      scope=GAPPS_SCOPES,
      sub=GAPPS_ADMIN+'@'+GAPPS_DOMAIN
  )
  
  http = credentials.authorize(Http(memcache))
  apps = build('admin', 'directory_v1', http=http)
  user = apps.users().get(userKey=GAPPS_USER +'@'+GAPPS_DOMAIN ).execute()
  console.log(user['email'])
  
  # ...
  </code></pre>
  
  <p>This works perfectly, however if I can, I would like to eliminate the credentials.json file by using a <code>AppAssertionCredentials</code> call to authenticate.</p>
  
  <p>As soon as I run the following code,  however:</p>
  
  <pre><code># ...
  
  import json
  from google.appengine.api import memcache
  from googleapiclient.discovery import build
  from httplib2 import Http
  from oauth2client.appengine import AppAssertionCredentials
  
  GAPPS_CREDENTIALS = 'credentials.json'
  GAPPS_SCOPES = [
    'https://www.googleapis.com/auth/admin.directory.user.readonly',
    'https://www.googleapis.com/auth/admin.directory.group.readonly',
    'https://www.googleapis.com/auth/admin.directory.group.member.readonly'
  ]
  GAPPS_ADMIN = 'admin'
  GAPPS_DOMAIN = 'domain.com'
  GAPPS_USER = 'user'
  
  # ...
  
  credentials = AppAssertionCredentials(scope=GAPPS_SCOPES,sub=GAPPS_ADMIN+'@'+GAPPS_DOMAIN)
  http = credentials.authorize(Http(memcache))
  apps = build('admin', 'directory_v1', http=http)
  user = apps.users().get(userKey=GAPPS_USER +'@'+GAPPS_DOMAIN ).execute()
  console.log(user['email'])
  
  # ...
  </code></pre>
  
  <p>I get a 403 error:</p>
  
  <pre><code>&lt;HttpError 403 when requesting https://www.googleapis.com/admin/directory/v1/users/user%domain.com?alt=json returned "Not Authorized to access this resource/api"&gt;
  </code></pre>
  
  <p>I suspect the issue may be that the built-in service account is not authenticated in Google Apps Dashboard,  however I am unable to find the account domain either in the Developers Console or the App Engine Console to be able to add these permissions. I have tried:</p>
  
  <ul>
  <li>adding all the service accounts found under Developers Console > Permissions, changing @developer.gserviceaccount.com to .apps.googleusercontent.com (the @cloudservices.gserviceaccount.com account causes error: <code>This client name has not been registered with Google yet.</code>)</li>
  <li>using the {project}.appspot.com domain: Google Apps errors with <code>This client name has not been registered with Google yet.</code></li>
  </ul>
  
  <p>Can anyone shed any light?</p>
  
  <p>Thanks</p>