使用C#调用Google Analytics Admin API时遇insufficientPermissions错误

问题场景 #

在C#中完成身份验证并配置权限Scope后，调用Google Analytics Admin API获取账户详情时，抛出403 Forbidden错误，提示insufficientPermissions。

相关代码 #

private static GoogleAnalyticsAdminService _analyticsService;

public static void IntializeAnalytics() {
    GoogleCredential credential = GoogleCredential.GetApplicationDefault();
        
    if (CloudManager.Credential.IsCreateScopedRequired)
    {
       credential = CloudManager.Credential.CreateScoped( 
       GoogleAnalyticsAdminService.Scope.AnalyticsReadonly, GoogleAnalyticsAdminService.Scope.AnalyticsManageUsers,
              GoogleAnalyticsAdminService.Scope.AnalyticsManageUsersReadonly, GoogleAnalyticsAdminService.Scope.AnalyticsEdit);
        }
    _analyticsService = new GoogleAnalyticsAdminService(
     new BaseClientService.Initializer()
     {
             
         HttpClientInitializer = credential,
         ApplicationName = CloudManager.ApplicationName

     });

    var response =  _analyticsService.Accounts.Get("accounts/Default Account for Firebase").Execute();
        
}

错误信息 #

Unhandled exception. The service analyticsadmin has thrown an exception.
HttpStatusCode is Forbidden.
Google.Apis.Requests.RequestError
Request had insufficient authentication scopes. [403]
Errors [
    Message[Insufficient Permission] Location[ - ] Reason[insufficientPermissions] Domain[global]
]

Google.GoogleApiException: The service analyticsadmin has thrown an exception. HttpStatusCode is Forbidden. Request had insufficient authentication scopes.
   at Google.Apis.Requests.ClientServiceRequest`1.ParseResponse(HttpResponseMessage response)
   at Google.Apis.Requests.ClientServiceRequest`1.Execute()

解决步骤 #

• 使用正确的GA4 Admin API Scope：你当前配置的是旧版Universal Analytics（UA）的Scope（如AnalyticsReadonly），而Google Analytics Admin API（针对GA4）需要专属Scope。替换为GoogleAnalyticsAdminService.Scope.AnalyticsAdminReadonly（只读场景足够）或GoogleAnalyticsAdminService.Scope.AnalyticsAdminEdit（需修改权限时使用）。修正后的Scope配置示例：

  credential = CloudManager.Credential.CreateScoped(
      GoogleAnalyticsAdminService.Scope.AnalyticsAdminReadonly
  );
  

• 清理凭据缓存：GoogleCredential会缓存已授权的Scope，修改后需删除本地缓存文件避免旧配置生效：
  • Windows：删除%APPDATA%\Google\Credentials目录下的文件
  • Linux/macOS：删除~/.config/google/credentials目录下的文件
• 确认服务账号权限：确保使用的服务账号（对应Application Default的账号）在GA4管理后台被授予对应权限：
  1. 进入GA4 Admin界面
  2. 选择目标账号 → 点击「账号权限」
  3. 添加用户，输入服务账号邮箱，分配至少Viewer角色（对应只读Scope）
• 修正资源名称格式：API要求账户ID格式为accounts/[数字ID]，而非显示名称。你当前使用的accounts/Default Account for Firebase是账户显示名，需替换为实际账户ID（可在GA4 Admin的账号设置中找到）。

内容的提问来源于stack exchange，提问作者Samaritan