title: Authorizing service account to access Picasa private data
body: <p>I try using the OAuth2 authentication with the PicasaService in a Java application.</p>
  
  <p>Maven dependencies:</p>
  
  <pre><code>&lt;dependency&gt;
   &lt;groupId&gt;com.google.gdata&lt;/groupId&gt;
   &lt;artifactId&gt;core&lt;/artifactId&gt;
   &lt;version&gt;${version.gdata}&lt;/version&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
   &lt;groupId&gt;com.google.apis&lt;/groupId&gt;
   &lt;artifactId&gt;google-api-services-oauth2&lt;/artifactId&gt;
   &lt;version&gt;${version.google-api-services-oauth2}&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>Versions:</p>
  
  <pre><code>&lt;version.gdata&gt;1.47.1&lt;/version.gdata&gt;
  &lt;version.google-api-services-oauth2&gt;v2-rev93-1.20.0&lt;/version.google-api-services-oauth2&gt;
  </code></pre>
  
  <p>I logged in with the album owner account to the Developers Console and created a service account and downloaded the p12 key file.</p>
  
  <p>I'm trying to authenticate with the service account:</p>
  
  <pre><code>GoogleCredential credential = new GoogleCredential.Builder()
              .setTransport(httpTransport)
              .setJsonFactory(JSON_FACTORY)
              .setServiceAccountId("XXX@developer.gserviceaccount.com")
              .setServiceAccountPrivateKeyFromP12File(new File("privatekey.p12"))
              .setServiceAccountScopes(Collections.singleton("https://picasaweb.google.com/data"))
              .build();
  
  credential.refreshToken();
  </code></pre>
  
  <p>It's working fine, the authentication is OK and an access token is retrieved.</p>
  
  <p>I can check the retrieved token with <a href="https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=TOKEN" rel="nofollow">https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=TOKEN</a></p>
  
  <pre><code>{
  issued_to: "XXX",
  audience: "XXX",
  scope: "https://picasaweb.google.com/data",
  expires_in: 3542,
  access_type: "offline"
  }
  </code></pre>
  
  <p>The PicasaService is using the authenticated GoogleCredentials:</p>
  
  <pre><code>PicasaService picasaService = new PicasaService("appname-from-developers-console");
  picasaService.setOAuth2Credentials(credential);
  </code></pre>
  
  <p>The service API calls returning with no error but the returned data contains only publicly available data, so it's like an unauthorized access.</p>
  
  <p>If I add the <strong>setServiceAccountUser()</strong> call to the GoogleCredential builder where the parameter value is the Picasa account's login name then <strong>refreshToken()</strong> throws a <strong>TokenResponseException</strong> that says the call is unauthorized (401) so it's like the service account has no access to this Picasa account however the Picasa account created the service account.</p>
  
  <p>On the developer console where I can select what APIs I'd like to use there is no Picasa/Photo whatever that has anything to do with the uploaded photos except the Google Picker API that says: "Google Picker API enables users to select photos, videos, maps and documents stored in Google servers." but it did not help.</p>
  
  <p>My question is how can I authorize the service account to have access to the private data or where is my code went wrong?</p>