[Python] `google.auth` python SDK not reading granted scopes from credentials file

I've run:

gcloud auth application-default login --client-id-file google_oauth_client_id.json --scopes="https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/calendar.calendars.readonly"


successfully. My browser opened, I granted the calendar and cloud-platform permissions to my test app, and the results were saved to disk:

Credentials saved to file:[/home/*****/.config/gcloud/application_default_credentials.json]


However, running the following snippet leads to a 403 error:

from google.auth import default
from google.auth.transport.requests import Request
from googleapiclient.discovery import build

SCOPES = ["https://www.googleapis.com/auth/calendar.calendars.readonly"]

credentials, project_id = default(scopes=SCOPES, quota_project_id='my-project-id')
credentials.refresh(Request())
access_token = credentials.token
service = build("calendar", "v3", credentials=credentials)
events = service.events().list(calendarId="My Calendar Id", maxResults=10, singleEvents=True, orderBy="startTime").execute()


At first I thought maybe I wasn't using the correct calendarId, but when I was in the debugger, I noticed that the credentials object has no scopes defined:

>>> (credentials.scopes, credentials.default_scopes, credentials.granted_scopes)
(None, None, None)


However, if I delete the application_default_credentials.json file the default method throws an appropriate error, so it does seem like it's reading from the file properly-- it's just not realizing that the permissions have been granted...

Continue reading...