title: access_denied when accessing Gmail API with auth scope https://mail.google.com/
body: <p>I am trying to read/write emails/folders inside Gmail mailboxes using the Gmail REST API. When adding the following Google auth scopes, emails can be read from Gmail REST API without any problem:</p>
  
  <p><a href="https://apps-apis.google.com/a/feeds/compliance/audit/" rel="nofollow">https://apps-apis.google.com/a/feeds/compliance/audit/</a>,
  <a href="https://www.googleapis.com/auth/admin.directory.user.readonly" rel="nofollow">https://www.googleapis.com/auth/admin.directory.user.readonly</a>, <strong><a href="https://www.googleapis.com/auth/gmail.readonly" rel="nofollow">https://www.googleapis.com/auth/gmail.readonly</a></strong>, 
  <a href="https://www.googleapis.com/auth/admin.directory.group.member.readonly" rel="nofollow">https://www.googleapis.com/auth/admin.directory.group.member.readonly</a>, <a href="https://www.googleapis.com/auth/admin.directory.group.readonly" rel="nofollow">https://www.googleapis.com/auth/admin.directory.group.readonly</a></p>
  
  <p>Note: The parameter <a href="https://www.googleapis.com/auth/gmail.readonly" rel="nofollow">https://www.googleapis.com/auth/gmail.readonly</a> correctly allows one to read from mailboxes.</p>
  
  <p>However, I need to be able to delete emails too. Thus, in line with the documentation at <a href="https://developers.google.com/gmail/api/auth/scopes?hl=ja" rel="nofollow">https://developers.google.com/gmail/api/auth/scopes?hl=ja</a>, one simply needs to include <a href="https://mail.google.com/" rel="nofollow">https://mail.google.com/</a> in place of <a href="https://www.googleapis.com/auth/gmail.readonly" rel="nofollow">https://www.googleapis.com/auth/gmail.readonly</a>. When adding the following auth scopes:</p>
  
  <p><a href="https://apps-apis.google.com/a/feeds/compliance/audit/" rel="nofollow">https://apps-apis.google.com/a/feeds/compliance/audit/</a>,
  <a href="https://www.googleapis.com/auth/admin.directory.user.readonly" rel="nofollow">https://www.googleapis.com/auth/admin.directory.user.readonly</a>, <strong><a href="https://mail.google.com/" rel="nofollow">https://mail.google.com/</a>,</strong> 
  <a href="https://www.googleapis.com/auth/admin.directory.group.member.readonly" rel="nofollow">https://www.googleapis.com/auth/admin.directory.group.member.readonly</a>, <a href="https://www.googleapis.com/auth/admin.directory.group.readonly" rel="nofollow">https://www.googleapis.com/auth/admin.directory.group.readonly</a></p>
  
  <p>... the error outputted is as follows:</p>
  
  <pre><code>    2015-07-27 10:27:59 i.c.s.a.cv [DEBUG] failed get labels for user
      com.google.api.client.auth.oauth2.TokenResponseException: 403 Forbidden
      {
         "error" : "access_denied",
         "error_description" : "Requested client not authorized."
      }
  </code></pre>
  
  <p>Surely, this is incorrect on the part of Google? What am I missing? Is the documentation incorrect? What auth scope needs to be added? </p>
  
  <p>I am interfacing with the Java Google API Client Library. See: <a href="https://developers.google.com/api-client-library/java/google-api-java-client/reference/1.20.0/overview-summary" rel="nofollow">https://developers.google.com/api-client-library/java/google-api-java-client/reference/1.20.0/overview-summary</a></p>
  
  <p>The delete request is as follows:</p>
  
  <pre><code>public void deleteMessages(Queue&lt;String&gt; messages, GoogleUserAdapter user) throws Exception {
  
      Gmail gmail = getService(user);
  
      JsonBatchCallback&lt;Void&gt; voidCallBack = new JsonBatchCallback&lt;Void&gt;() {
          @Override
          public void onSuccess(Void t, HttpHeaders responseHeaders) throws IOException {
              logger.debug("delete success");
  
          }
          @Override
          public void onFailure(GoogleJsonError e, HttpHeaders responseHeaders) throws IOException {
              logger.debug("failed to delete message:"+e.getMessage());
          }
      };
      while (!messages.isEmpty()) {
          if (Thread.currentThread().isInterrupted()) 
              throw new InterruptedException();
  
          BatchRequest batch = gmail.batch();
          for (int i = 0; i &lt; MAX_REQUESTS; i++) {
              if (messages.isEmpty() || Thread.currentThread().isInterrupted()) 
                  break;
              gmail.users().messages().delete(user.getId(), messages.poll()).queue(batch, voidCallBack);
          }
  
          batch.execute();
      }
  }
  </code></pre>
  
  <p>The credential is created as follows:</p>
  
  <pre><code>   private GoogleCredential getCredentials(JsonFactory jsonFactory, HttpTransport httpTransport, String impersonateAccount) throws Exception {
  
      Preconditions.checkNotNull(Strings.emptyToNull(impersonateAccount), "Google impersonate account is null");
       Preconditions.checkNotNull(Strings.emptyToNull(connection.getServiceAccountId()), "Service Account Email address is null");
      Preconditions.checkNotNull(connection.getServiceAccountPrivateKey(), "Service Account Private Key is null");
  
      GoogleCredential credential = new GoogleCredential.Builder()
            .setTransport(httpTransport)
            .setJsonFactory(jsonFactory)
            .setServiceAccountId(connection.getServiceAccountId())
            .setServiceAccountScopes(
                      Arrays.asList(DirectoryScopes.ADMIN_DIRECTORY_USER_READONLY, GmailScopes.MAIL_GOOGLE_COM,
                              "https://apps-apis.google.com/a/feeds/compliance/audit/",
                              DirectoryScopes.ADMIN_DIRECTORY_GROUP_MEMBER_READONLY, 
                              DirectoryScopes.ADMIN_DIRECTORY_GROUP_READONLY))
            .setServiceAccountUser(impersonateAccount)
            .setServiceAccountPrivateKey(connection.getServiceAccountPrivateKey().getPrivateKey())
            .build();
      setHttpTimeout(credential);
      return credential;
  }
  </code></pre>
  
  <p>The exact error that occurs on delete is:</p>
  
  <pre><code>   failed to delete message:Insufficient Permission
  </code></pre>
  
  <p>Jamie</p>