title: Google Calendar API 401 "Invalid Credentials"
body: <p>Some (but not all) Google accounts consistently respond with a 401 when trying to access the Google Calendar API despite tokeninfo telling me the access token I'm using has the proper scope (see curl output below). I can successfully obtain a new access token using a refresh token, but the calendar api continues to 401.</p>
  
  <p>Does anyone have an idea why this might be happening?</p>
  
  <pre><code>$ curl -v https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=[redacted]
  *   Trying 216.58.195.74...
  * Connected to www.googleapis.com (216.58.195.74) port 443 (#0)
  * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  * Server certificate: *.googleapis.com
  * Server certificate: Google Internet Authority G2
  * Server certificate: GeoTrust Global CA
  &gt; GET /oauth2/v3/tokeninfo?access_token=[redacted] HTTP/1.1
  &gt; Host: www.googleapis.com
  &gt; User-Agent: curl/7.49.1
  &gt; Accept: */*
  &gt;
  &lt; HTTP/1.1 200 OK
  &lt; Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  &lt; Pragma: no-cache
  &lt; Expires: Mon, 01 Jan 1990 00:00:00 GMT
  &lt; Date: Tue, 18 Oct 2016 22:00:45 GMT
  &lt; Vary: X-Origin
  &lt; Content-Type: application/json; charset=UTF-8
  &lt; X-Content-Type-Options: nosniff
  &lt; X-Frame-Options: SAMEORIGIN
  &lt; X-XSS-Protection: 1; mode=block
  &lt; Server: GSE
  &lt; Alt-Svc: quic=":443"; ma=2592000; v="36,35,34,33,32"
  &lt; Accept-Ranges: none
  &lt; Vary: Origin,Accept-Encoding
  &lt; Transfer-Encoding: chunked
  &lt;
  {
   "azp": "[redacted].apps.googleusercontent.com",
   "aud": "[redacted].apps.googleusercontent.com",
   "sub": "[redacted]",
   "scope": "https://www.googleapis.com/auth/plus.me https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/calendar",
   "exp": "1476831626",
   "expires_in": "3581",
   "email": "[redacted]",
   "email_verified": "true",
   "access_type": "offline"
  }
  * Connection #0 to host www.googleapis.com left intact
  
  
  $ curl -v https://www.googleapis.com/calendar/v3/users/me/calendarList?access_token=[redacted]
  *   Trying 216.58.195.74...
  * Connected to www.googleapis.com (216.58.195.74) port 443 (#0)
  * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  * Server certificate: *.googleapis.com
  * Server certificate: Google Internet Authority G2
  * Server certificate: GeoTrust Global CA
  &gt; GET /calendar/v3/users/me/calendarList?access_token=[redacted] HTTP/1.1
  &gt; Host: www.googleapis.com
  &gt; User-Agent: curl/7.49.1
  &gt; Accept: */*
  &gt;
  &lt; HTTP/1.1 401 Unauthorized
  &lt; Vary: X-Origin
  &lt; WWW-Authenticate: Bearer realm="https://accounts.google.com/", error=invalid_token
  &lt; Content-Type: application/json; charset=UTF-8
  &lt; Date: Tue, 18 Oct 2016 22:01:14 GMT
  &lt; Expires: Tue, 18 Oct 2016 22:01:14 GMT
  &lt; Cache-Control: private, max-age=0
  &lt; X-Content-Type-Options: nosniff
  &lt; X-Frame-Options: SAMEORIGIN
  &lt; X-XSS-Protection: 1; mode=block
  &lt; Server: GSE
  &lt; Alt-Svc: quic=":443"; ma=2592000; v="36,35,34,33,32"
  &lt; Accept-Ranges: none
  &lt; Vary: Origin,Accept-Encoding
  &lt; Transfer-Encoding: chunked
  &lt;
  {
   "error": {
    "errors": [
     {
      "domain": "global",
      "reason": "authError",
      "message": "Invalid Credentials",
      "locationType": "header",
      "location": "Authorization"
     }
    ],
    "code": 401,
    "message": "Invalid Credentials"
   }
  }
  * Connection #0 to host www.googleapis.com left intact
  </code></pre>