title: Enable APIs using serviceusage API with a service account
body: <p>I want to create an automatic deployment of GCP for clients.</p>
  
  <p>In order to do that, I have opened a page for them to login with google, and then enabled the IAM API and the Service Usage API.</p>
  
  <p>Then I have created a service account that I want to use from this point forward in order to enable other required APIs on demand and not all at once.</p>
  
  <p>When I try to enable the cloudkms API, I get </p>
  
  <pre><code>googleapiclient.errors.HttpError: &lt;HttpError 403 when requesting https://serviceusage.googleapis.com/v1/projects/x-y-z/services/cloudkms.googleapis.com?alt=json returned "The caller does not have permission"
  </code></pre>
  
  <p>I tried using the service account credentials (google.auth.jwt.Credentials) that I have created from the response of creating the service account, and I have added all the required permissions. I don't want to grant the role owner to the service account, because I want the account to have as less permissions as possible.</p>
  
  <p>When I try to get the status of cloudkms API using the user's permissions, it works.</p>
  
  <p>I have seen some solutions addressing me needing to create credentials for the service account here : <a href="https://console.developers.google.com/apis/credentials" rel="noreferrer">https://console.developers.google.com/apis/credentials</a> but I really need to do this programatically as well.</p>
  
  <p>My code:</p>
  
  <pre><code>credentials = jwt.Credentials.from_service_account_file(service_account_info['email'] + '.json', audience="https://www.googleapis.com/auth/cloud-platform")
  # credentials = GoogleCredentials.get_application_default() - it works with this
  service_usage = googleapiclient.discovery.build('serviceusage', 'v1', credentials=credentials)
  service_usage.services().get(name="projects/&lt;project_id&gt;/services/cloudkms.googleapis.com").execute()
  </code></pre>
  
  <p>The error was mentioned above.</p>