title: Unable to get token using Google APIs [google-oauth-java-client-1.12.0-beta] for service account flow
body: <p>I am using Google APIs (version google-oauth-java-client-1.12.0-beta) to get a OAuth2 access token but got back "invalid_grant".
  Ref: <a href="https://developers.google.com/accounts/docs/OAuth2ServiceAccount" rel="nofollow">https://developers.google.com/accounts/docs/OAuth2ServiceAccount</a></p>
  
  <p>Here is the code:</p>
  
  <pre><code>import com.google.api.client.auth.jsontoken.JsonWebSignature;
  import com.google.api.client.auth.jsontoken.JsonWebToken;
  import com.google.api.client.auth.jsontoken.RsaSHA256Signer;
  import com.google.api.client.auth.oauth2.TokenRequest;
  import com.google.api.client.auth.oauth2.TokenResponse;
  import com.google.api.client.http.GenericUrl;
  import com.google.api.client.http.HttpTransport;
  import com.google.api.client.http.javanet.NetHttpTransport;
  import com.google.api.client.json.JsonFactory;
  import com.google.api.client.json.jackson2.JacksonFactory;
  import com.google.api.client.util.Clock;
  
  import java.io.FileInputStream;
  import java.io.IOException;
  
  import java.security.GeneralSecurityException;
  import java.security.KeyStore;
  import java.security.KeyStoreException;
  import java.security.NoSuchAlgorithmException;
  import java.security.PrivateKey;
  import java.security.UnrecoverableKeyException;
  import java.security.cert.CertificateException;
  
  
  public class TestClient
  {
    private static PrivateKey getPrivateKey(String keyFile, String alias, String password)
      throws KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException, UnrecoverableKeyException
    {
      KeyStore keystore = KeyStore.getInstance("PKCS12");
      keystore.load(new FileInputStream(keyFile), password.toCharArray());
      PrivateKey privateKey = (PrivateKey) keystore.getKey(alias, password.toCharArray());
  
      return privateKey;
    }
  
    public static void main(String[] args)
      throws GeneralSecurityException, IOException
    {
      String password = "notasecret";
      String alias = "privatekey";
      String keyFile = "&lt;private key file&gt;.p12";
      String serviceAccountScopes = "https://www.googleapis.com/auth/urlshortener";
      String serviceAccountUser = "user1@gmail.com";
      String serviceAccountId = "&lt;a/c id&gt;.apps.googleusercontent.com";
      JsonWebSignature.Header header = new JsonWebSignature.Header();
      header.setAlgorithm("RS256");
      header.setType("JWT"); 
  
      JsonWebToken.Payload payload = new JsonWebToken.Payload(Clock.SYSTEM);
      long currentTime = Clock.SYSTEM.currentTimeMillis();
      payload.setIssuer(serviceAccountId)
         .setAudience("https://accounts.google.com/o/oauth2/token")
         .setIssuedAtTimeSeconds(currentTime / 1000)
         .setExpirationTimeSeconds(currentTime / 1000 + 3600)
         .setPrincipal(serviceAccountUser);
      payload.put("scope", serviceAccountScopes); 
      System.out.println(payload.toPrettyString());
  
      PrivateKey serviceAccountPrivateKey = getPrivateKey(keyFile, alias, password);
      String assertion = RsaSHA256Signer.sign(serviceAccountPrivateKey, getJsonFactory(), header, payload);     
      TokenRequest request = new TokenRequest(getTransport(), getJsonFactory(), new GenericUrl(getTokenServerEncodedUrl()), "assertion");     
  
      request.put("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");     
      request.put("assertion", assertion);     
      TokenResponse resp = request.execute();    
      System.out.println("token : " + resp.getAccessToken());
    }
  
    private static String getTokenServerEncodedUrl()
    {
      return "https://accounts.google.com/o/oauth2/token";
    }
  
    private static JsonFactory getJsonFactory()
    {
      return new JacksonFactory();
    }
  
    private static HttpTransport getTransport()
    {
      return new NetHttpTransport();
    }
  }
  </code></pre>
  
  <p>Result:</p>
  
  <pre><code>Exception in thread "main" com.google.api.client.auth.oauth2.TokenResponseException: 400 Bad Request
  {
    "error" : "invalid_grant"
  }
      at com.google.api.client.auth.oauth2.TokenResponseException.from(TokenResponseException.java:103)
      at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:303)
      at com.google.api.client.auth.oauth2.TokenRequest.execute(TokenRequest.java:323)
  </code></pre>
  
  <p>What is the problem here? any hint would be appreciated.</p>