title: Get ACCESS_TOKEN_SCOPE_INSUFFICIENT error migrating to People API
body: <p>I have a desktop Java app that I am migrating from Google Contacts API to People API.  I have some of it working.  For example, I can retrieve contact information.  But when I tried to create a new contact, I get the following error:</p>
  <pre><code>com.google.api.client.googleapis.json.GoogleJsonResponseException: 403 Forbidden
  POST https://people.googleapis.com/v1/people:createContact
  {
    &quot;code&quot; : 403,
    &quot;details&quot; : [ {
     &quot;@type&quot; : &quot;type.googleapis.com/google.rpc.ErrorInfo&quot;,
     &quot;reason&quot; : &quot;ACCESS_TOKEN_SCOPE_INSUFFICIENT&quot;
    } ],
    &quot;errors&quot; : [ {
      &quot;domain&quot; : &quot;global&quot;,
      &quot;message&quot; : &quot;Insufficient Permission&quot;,
      &quot;reason&quot; : &quot;insufficientPermissions&quot;
    } ],
    &quot;message&quot; : &quot;Request had insufficient authentication scopes.&quot;,
    &quot;status&quot; : &quot;PERMISSION_DENIED&quot;
  }
  </code></pre>
  <p>Here's the relevant code:</p>
  <pre><code>protected void createContact() throws Exception {
      
      Credential credential = authorize(PeopleServiceScopes.CONTACTS, &quot;people&quot;);
      
      PeopleService service = new PeopleService.Builder(
                httpTransport, JSON_FACTORY, credential).setApplicationName(APPLICATION_NAME).build();
  
      
      Person contactToCreate = new Person();
      List&lt;Name&gt; names = new ArrayList&lt;Name&gt;();
      names.add(new Name().setGivenName(&quot;John&quot;).setFamilyName(&quot;Doe&quot;));
      contactToCreate.setNames(names);
  
      Person createdContact = service.people().createContact(contactToCreate).execute();
      System.out.println(&quot;CREATED Contact: &quot; + createdContact.getNames().get(0).getDisplayName());
  }
  
  protected Credential authorize(String scope, String subDir) throws Exception {
      
      File dataStoreDir = new File(System.getProperty(&quot;user.home&quot;), &quot;.store/myapp/&quot; + cfg.dataStore + &quot;/&quot; + subDir);
      
      // initialize the transport
      httpTransport = GoogleNetHttpTransport.newTrustedTransport();
  
      // initialize the data store factory
      dataStoreFactory = new FileDataStoreFactory(dataStoreDir);
      
      // load client secrets
      GoogleClientSecrets clientSecrets = GoogleClientSecrets.load(JSON_FACTORY,
          new InputStreamReader(SyncMgr.class.getResourceAsStream(&quot;/client_secrets.json&quot;)));
      if (clientSecrets.getDetails().getClientId().startsWith(&quot;Enter&quot;)
              || clientSecrets.getDetails().getClientSecret().startsWith(&quot;Enter &quot;)) {
          System.out.println(
                  &quot;Enter Client ID and Secret from https://code.google.com/apis/console/?api=calendar &quot;
                  + &quot;into /client_secrets.json&quot;);
          System.exit(1);
      }
      // set up authorization code flow
      GoogleAuthorizationCodeFlow flow = new GoogleAuthorizationCodeFlow.Builder(
              httpTransport, JSON_FACTORY, clientSecrets,
              Collections.singleton(scope)).setDataStoreFactory(dataStoreFactory).build();
      // authorize
      return new AuthorizationCodeInstalledApp(flow, new LocalServerReceiver()).authorize(cfg.gUser);
  }
  </code></pre>
  <p>When I first ran it, I had the scope set to CONTACTS_READONLY.  And I got the consent screen.  But then I changed the scope to CONTACTS when I added the code to create a new contact.  And that's when I got the ACCESS_TOKEN_SCOPE_INSUFFICIENT error.</p>
  <p>I saw in another post that I need to force your app to reauthorize the user when you change the scope, so that you get the consent screen again.  But I'm not sure how to do that.  Any suggestions?</p>
  <p>Thanks.</p>
  <p>UPDATE 1/4/22</p>
  <p>I tried Gabriel's suggestion of removing access to the application. After removing access, I ran the application again. This time I got this error on the execute() call:</p>
  <pre><code>com.google.api.client.auth.oauth2.TokenResponseException: 400 Bad Request
  POST https://oauth2.googleapis.com/token
  {
    &quot;error&quot; : &quot;invalid_grant&quot;,
    &quot;error_description&quot; : &quot;Token has been expired or revoked.&quot;
  }
  </code></pre>
  <p>And even the execute() statement that worked before to retrieve contacts is giving the same error now.</p>
  <p>My application also used the Calendar API. I didn't touch that code. But when I try to use it, I get the same &quot;invalid_grant&quot; error.  What do I do now?</p>