title: OAuth 2.0 for Server to Server Applications: two or three parameters? (Or: Can some Google engineers possibly not count up to three? :)
body: <p>I'm trying to obtain an Google OAuth 2.0 access token for a service account but receive an <code>invalid_grant</code> <a href="https://stackoverflow.com/search?q=invalid_grant">error</a> instead. I've checked my various artifacts (private key, etc.) and clock timings but have not been able to resolve this so far.</p>
  
  <p>There is one possibly related item that seems odd: Google's <a href="https://developers.google.com/accounts/docs/OAuth2ServiceAccount" rel="nofollow noreferrer">documentation</a> says</p>
  
  <blockquote>
    <p><em>Three</em> parameters are required in the HTTPs POST, and these are shown
    below</p>
  </blockquote>
  
  <p>This is followed by a table with <em>two</em> rows that specifies <em>two</em> parameters (<code>grant_type</code> and <code>assertion</code>). Could it be that a third is also needed (I've seen examples that also use <code>assertion_type</code> in some fashion)? Could it be that (some) Google engineers (or perhaps yours truly) cannot count up to three? :) </p>
  
  <p>In summary: What are the appropriate parameters? It seems unclear from Google's current documentation.</p>
  
  <p><strong>UPDATE:</strong> Here is some further information: I can't use the Google API Client Library, because my application requires a language other than those currently not supported by Google. Therefore I have to implement the logic for creating and signing JWTs, etc., as is normally discouraged. I have confirmed that my service account artifacts are in order: I can use them with the Google APIs Client Library for Java to access the same calendar (from another than my target platform, i.e.). In particular, my "client_id" is of the form "...@developer.gserviceaccount.com" and my key is a 128-bit RSA private key, both as obtained from the <a href="https://code.google.com/apis/console" rel="nofollow noreferrer">Google APIs Dashboard</a>.</p>