title: Google Admin SDK - Exception access_denied Requested client not authorized
body: <p>I hope someone can help me with.</p>
  
  <p>Please take a look at the source code below. When the Execute is hit at the end. I will get the following error:</p>
  
  <p><em>Google.Apis.Auth.OAuth2.Responses.TokenResponseException was unhandled
    _HResult=-2146233088
    _message=Error:"access_denied", Description:"Requested client not authorized.", Uri:""</em></p>
  
  <p>I have tried a lot of things. Creating user, list groups etc. etc. (with correct scopes) but every time I'm getting the same error.</p>
  
  <p>I have created a service account and all of the APIs in the Google Developers Console are set to "on"
  The user I use for impersonation is a full administrator. </p>
  
  <p>I have tried several things, but I must do something stupid. 
  The code looks a lot like an other issue on Stack Overflow : <a href="https://stackoverflow.com/questions/20956767/google-admin-sdk-unable-to-create-user-exception-403-forbidden">Google Admin SDK Unable to Create User - Exception 403 Forbidden</a>
  But mine is not going to work. Can anyone tells me what I'm forgetting? </p>
  
  <pre><code>private static readonly string[] Scopes = new string[] { DirectoryService.Scope.AdminDirectoryUser, DirectoryService.Scope.AdminDirectoryGroup, DirectoryService.Scope.AdminDirectoryGroupMember };
  
      static void Main(string[] args)
      {
  
          String serviceAccountEmail = "***@developer.gserviceaccount.com";
          var certificate = new X509Certificate2(@"file.p12", "notasecret", X509KeyStorageFlags.Exportable);
          ServiceAccountCredential credential = new ServiceAccountCredential(
             new ServiceAccountCredential.Initializer(serviceAccountEmail)
             {
                 Scopes = Scopes,
                 User = "admin email address",
  
             }.FromCertificate(certificate));
          var service = new DirectoryService(new BaseClientService.Initializer()
         {
             HttpClientInitializer = credential,
             ApplicationName = "User Provisioning",
         });
  
          User newuserbody = new User();
          UserName newusername = new UserName();
          newuserbody.PrimaryEmail = "bbacon@correct.domain";
          newusername.GivenName = "Bob";
          newusername.FamilyName = "Bacon";
          newuserbody.Name = newusername;
          newuserbody.Password = "iambacon";
  
          Google.Apis.Admin.Directory.directory_v1.Data.User results = service.Users.Insert(newuserbody).Execute();
  
          Console.WriteLine("Press any key to continue!");
          Console.ReadKey();
      }
  </code></pre>