 <p>After investigation it seems that getting a 403 error happens if the account that is set in <code>.setServiceAccountUser("admin.of.my@domain.com")</code> is not a "Super Admin" of the domain.</p> <p>However in the case above "admin.of.my@domain.com" is indeed a Super Admin of the domain. Also the code works well with any other Super Admin of the domain which leads to believe that there is something wrong with the account "admin.of.my@domain.com" in particular.</p> <p>If this happens to anyone else - a.k.a. an account set as "Super Admin" which does not work to access Admins-only APIs through Service Accounts - make sure you let us know in the comments below and we'll investigate further if this impacts lots of people.</p>