Can't push scripts by service account

[choreo]

Hi. I connected Apps Script with Google Cloud project and created a service account.

As README says,

To use a service account to push or pull files from Apps Script, the scripts must be shared with the service account with the appropriate role (e.g. Editor in able to push.)

I shared the script with the account's email ( xxxxxxxxxx@myproject.iam.gserviceaccount.com ) as Editor.
$ clasp pull --adc was successful.

$ clasp pull --adc
└─ dist/appsscript.json
└─ dist/index.js
Pulled 2 files.

But I got this when I ran $ clasp push --adc

User has not enabled the Apps Script API. Enable it by visiting https://script.google.com/home/usersettings then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.

Sorry if I miss some configurations and this is not an issue. But at this moment, the App Script document (the link is also provided at the bottom of README ) says

The Apps Script API does not work with service accounts.

I was wondering if push or deploy is ever possible. I am not sure if this is related, but Domain-wide delegation scope for the service account is like this.

https://www.googleapis.com/auth/script.projects
https://www.googleapis.com/auth/script.deployments
https://www.googleapis.com/auth/script.webapp.deploy
https://www.googleapis.com/auth/drive.metadata.readonly
https://www.googleapis.com/auth/drive.file
https://www.googleapis.com/auth/service.management
https://www.googleapis.com/auth/logging.read
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile
https://www.googleapis.com/auth/cloud-platform
https://www.googleapis.com/auth/drive

Specifications

• Node version (node -v):v22.14.0
• Version (clasp -v):3.0.3-alpha
• OS (Mac/Linux/Windows):Mac

[Nu11u5]

Did you enable the AppsScript API in your GCP project?

Domain-wide delegation is for impersonating other accounts to access their data. It needs a specially crafted request that specifies which account it is impersonating. Clasp doesn't do this.

[choreo]

Yes, AppsScript API is listed on "API & Services" page of my Google Cloud console...

[sqrrrl]

Yeah, I had only tested with pull and mistakenly assumed that if that worked push would as well -- that "enable apps script API" setting should apply to all operations in the API. But possible that the fact that it works for pulls is more of a bug than a feature :/

In any case, will see if we can get that enabled by default for service accounts

[ghaskins99]

Hi @sqrrrl! Appreciate the transparency in your response -- is there any update you can give on getting service account perms enabled to push to the apps script API?
My team is looking at using the workarounds described by a few other users in related issues (updating creds in GH actions à la https://github.com/ericanastas/deploy-google-app-script-action), but it would be great to know if it's looking like the service account / ADC method will be viable in the near future.

[denizformsapp]

Hi, I was facing the same issue, and I managed to resolve it by linking the Google Cloud project number (not the project ID) in the App Script project settings.

[jddcef]

Hi, I was facing the same issue, and I managed to resolve it by linking the Google Cloud project number (not the project ID) in the App Script project settings.

It only accepts the project number, still doesn't work for me.

Also report at https://issuetracker.google.com/issues/442055772

[aaronbrezel]

I may have run into a similar issue. Possibly the same/similar experience described here.

I am attempting to use WIF, a GCP service account and clasp push to deploy from GitHub Actions. But have run into some issues.

I originally attempted to use the --adc flag to tell clasp to plug directly into credentials stored at GOOGLE_APPLICATION_CREDENTIALS, but after that appeared to not work, I tried casting the WIF authentication process into an OAuth token.

Here's the section of my GitHub workflow that authenticates a Google service account:

jobs:
  deploy-dev:
    steps:
      ...
      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ vars.WIF_PROVIDER }}
          service_account: ${{ vars.WIF_SERVICE_ACCOUNT }}
          token_format: 'access_token'
          access_token_scopes: 'https://www.googleapis.com/auth/script.projects,https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/script.deployments'
     ...

And the section that casts into the format clasp is supposed to be able to use:

      ...
      - name: Write clasp credentials
        env:
          ACCESS_TOKEN: ${{ steps.auth.outputs.access_token }}
        run: |
          python3 -c "
          import json, os
          json.dump({'tokens': {'default': {'type': 'authorized_user', 'client_id': '1072944905499-vm2v2i5dvn0a0d2o4ca36i1vge8cvbn0.apps.googleusercontent.com', 'client_secret': 'v6V3fKV_zWU7iw1DrpO1rknX', 'refresh_token': 'not-used', 'access_token': os.environ['ACCESS_TOKEN'], 'token_type': 'Bearer', 'expiry_date': 9999999999999}}}, open(os.path.expanduser('~/.clasprc.json'), 'w'))
          "
      - name: Deploy to dev
        env:
          GOOGLE_APPLICATION_CREDENTIALS: ''
        run: npm run build && cp .clasp.dev.json .clasp.json && npx clasp push

This triggers the following error during deployment:

User has not enabled the Apps Script API. Enable it by visiting https://script.google.com/home/usersettings then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.

I've already added the service account as an editor on the Apps Script project. Is there anything I can do to open up access from the service account? Or am I totally blocked?

[aaronbrezel]

Just for visibility, there is an update at: https://issuetracker.google.com/issues/442055772. Apparently, rejecting service accounts from using the Apps Script API is intended behavior. My interpretation is that this authentication path is completely blocked.

I'm not sure if there's another avenue to perform code deployments through GitHub.