调用Google Workspace Marketplace API查询插件安装时遇503错误

目标 #

我有一个面向Google Forms的公开Google Workspace Marketplace编辑器插件，想要在Google Apps Script中通过Google Workspace Marketplace API查询它的安装与卸载记录。

已尝试的实现方案 #

• 创建了新的Google Apps Script，关联到插件所在的同一GCP项目
• 由于个人用户身份请求API会复用插件的OAuth同意屏幕和范围导致错误，因此采用服务账号并配置独立范围
• 使用Compute Engine默认服务账号，已为其启用全域委派和Google Workspace Marketplace OAuth客户端
• 创建了JSON格式的服务账号密钥文件，并将内容复制到脚本中

脚本代码 #

const serviceAccount = {
  "type": "service_account",
  "project_id": "<<MY PROJECT ID>>",
  "private_key_id": "<<MY PRIVATE KEY>>",
  "private_key": "<<MY PRIVATE KEY>>",
  "client_email": "<<MY CLIENT EMAIL>>",
  "client_id": "<<MY CLIENT ID>>",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "<<MY CERT URL>>"
};

const { private_key, client_email, project_id } = serviceAccount;

const createService = (name, serviceAccount, scopes, userToImpersonate) => {
  return OAuth2.createService(name)
    .setSubject(userToImpersonate)
    .setTokenUrl('https://accounts.google.com/o/oauth2/token')
    .setPrivateKey(serviceAccount.private_key)
    .setIssuer(serviceAccount.client_email)
    .setPropertyStore(PropertiesService.getScriptProperties())
    .setCache(CacheService.getUserCache())
    .setLock(LockService.getUserLock())
    .setScope(scopes);
};

const sendRequest = (url, oauthParams) => {
  const { serviceName, serviceAccount, scopes, userToImpersonate } = oauthParams;

  const oauthService = createService(serviceName, serviceAccount, scopes, userToImpersonate);

  if (!oauthService.hasAccess()) {
    console.log('ERROR IS ' + oauthService.getLastError());
    return;
  }

  const headers = {
    Authorization: `Bearer ${oauthService.getAccessToken()}`,
  };

  const options = {
    method: 'get',
    headers,
    muteHttpExceptions: true,
  };

  return UrlFetchApp.fetch(url, options).getContentText();
};

const getLicenseNotifications = () => {
  const url = 'https://appsmarket.googleapis.com/appsmarket/v2/licenseNotification/<<MY APP ID>>?maxResults=2';
  const oauthParams = {
    serviceName: 'GWMservice',
    serviceAccount,
    scopes: ['https://www.googleapis.com/auth/appsmarketplace.license'],
    userToImpersonate: '<<MY USER>>@<<MY DOMAIN>>.com',
  };

  console.log(sendRequest(url, oauthParams));
};

Google Apps Script清单文件 #

{
  "timeZone": "Europe/Berlin",
  "dependencies": {
    "libraries": [
      {
        "userSymbol": "OAuth2",
        "version": "43",
        "libraryId": "1B7FSrk5Zi6L1rSxxTDgDEUsPzlukDsi4KGuTMorsTQHhGBzBkMun4iDF"
      }
    ]
  },
  "exceptionLogging": "STACKDRIVER",
  "runtimeVersion": "V8",
  "oauthScopes": [
    "https://www.googleapis.com/auth/appsmarketplace.license",
    "https://www.googleapis.com/auth/script.external_request"
  ]
}

错误信息 #

执行脚本时收到以下503错误：

{
  "error": {
    "code": 503,
    "message": "临时错误，请稍后重试。",
    "errors": [
      {
        "message": "临时错误，请稍后重试。",
        "domain": "global",
        "reason": "backendError"
      }
    ]
  }
}

解决建议 #

1. 先排除临时服务波动 #

503属于后端服务临时不可用，先间隔10-30分钟重试几次，确认不是Google服务端的临时故障。如果多次重试后依然报错，再排查配置问题。

2. 检查服务账号权限配置 #

• 确认服务账号已正确启用全域委派：进入GCP控制台【IAM与管理】→【服务账号】，找到目标账号，编辑并勾选「启用全域委派」
• 确认在Google Admin控制台的【安全】→【API控制】→【域名宽限期委派】中，已为服务账号的客户端ID添加https://www.googleapis.com/auth/appsmarketplace.license范围

3. 修正API请求URL #

检查URL中的<<MY APP ID>>是否替换为插件的实际应用ID（可在Google Workspace Marketplace控制台的插件详情页获取）。

4. 调整OAuth2服务配置 #

• 将createService中的setTokenUrl改为https://oauth2.googleapis.com/token，原地址是授权端点而非令牌端点
• 验证服务账号的private_key格式是否正确：JSON中的私钥需要转义换行，确保脚本中复制的私钥完整保留了原格式

5. 验证OAuth范围声明 #

确认GCP项目的OAuth同意屏幕中已声明https://www.googleapis.com/auth/appsmarketplace.license范围，公开插件需确保该范围已通过Google的OAuth审核。

6. 排查授权流程 #

在sendRequest函数中添加日志，打印获取到的AccessToken，确认授权流程是否正常：

console.log('获取到的AccessToken:', oauthService.getAccessToken());

内容的提问来源于stack exchange，提问作者JShinigami