How do I verify an in-app subscription token using a custom service account on GCP?

Below is a summary of steps and debugging techniques that can help you pinpoint why your API call is using insufficient credentials, and how to force the use of your custom service account with explicit credentials.

---

1. Use Explicit Credentials

The log output shows that the HTTP client is attempting to get credentials from the “default” service account (via metadata) rather than your custom JSON key. To force your custom service account credentials, load them explicitly:

PYTHONCopied
from google.oauth2 import service_account
import googleapiclient.discovery

SCOPES = ["https://www.googleapis.com/auth/androidpublisher"]
SERVICE_ACCOUNT_FILE = "path/to/your-service-account-key.json"

credentials = service_account.Credentials.from_service_account_file(
    SERVICE_ACCOUNT_FILE, scopes=SCOPES
)
service = googleapiclient.discovery.build("androidpublisher", "v3", credentials=credentials)

# Use the token received from your app to verify the purchase
result = service.purchases().subscriptionsv2().get(
    packageName="com.mycompany.myapp", token="TOKEN_PASSED_IN_FROM_MY_APP"
).execute()

This will ensure the correct service account email is used. You can confirm which service account is being used by printing:

PYTHONCopied
print(credentials.service_account_email)

---

2. Verify Service Account Permissions in Google Play Console

Even after using explicit credentials, make sure of the following:

• The service account email (from your JSON key) is added to the Google Play Console under Settings > Developer Account > Users & Permissions.
• It has the appropriate role (even temporarily grant admin access for testing).

A misconfiguration here will still cause permission issues even when using the correct credentials.

---

3. Debugging the Credential Chain

If you’re still getting errors:

• Check Logging: Increase the logging level to see verbose output from the googleapiclient. You might want to enable logging with something like:

  PYTHONCopied
  import logging
  logging.basicConfig(level=logging.DEBUG)

• Verify Request Credentials: If you can, inspect the outgoing HTTP requests to ensure that the Authorization header is correctly set with an access token obtained via your service account—not a default Compute Engine token.

• Test on Local vs. GCE: If you’re running on a Compute Engine instance, the client library might fall back to default credentials. Running your verification process locally with explicit credentials should help isolate the problem.

---

4. Understanding the “default” in Logs

The log snippet:

Making request: GET http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/?recursive=true

indicates that your code is trying to use the environment’s default credentials. This behavior is common if no explicit credentials object is provided to the build function. By specifying your custom credentials (via the JSON key), you override that behavior and ensure your API calls are authenticated with the correct service account.

---

Conclusion

By switching to explicit credentials and confirming that your service account is correctly configured both in your GCP project (and on the machine you’re running on) and in the Play Console, you should resolve the 401 permission error. Once this is in place, your subscription token validation should work as expected.

If further debugging is needed, inspect your outgoing HTTP requests to verify that the expected credentials (with the correct service account email) are being used.