IssueTracker

Same behavior here.

Any update on when this issue will be addressed?

Any update on this?  Does anyone know of any work arounds?

Any feedback/workaround appreciated

Currently, by design, service accounts are not allowed to access the Execution API. However, we are looking at adding this functionality, and have an internal feature request to address it. Please follow this issue for updates as the work progresses.

I hit this - it turns out I was having problems because I wasn't setting the `Content-Type` to `application/json`

Also - I sent parameters as an array rather then key value pairs. ie:

headers: {
  "Authorization" => "Bearer #{TOKEN}",
  "Content-Type" => "application/json"
}

body: {
  "function" => "funcName"
  "parameters" => [ "param1", "param2"]
}.to_json

This is really needed feature, +1

NEEDED +1

+!1!

Did I get right, that it is not possible to use Execution API in a mode, when I want server to server script calls and authorization without user intervention?
Google instruction directs using service accounts, right? Is there any other way to call those scripts?

I think you got it right.  Until they add the ability to use service accounts, user involvement is required.

Looks like there may be a workaround : https://plus.google.com/+JulienBouquillon/posts/6sBKpbpzBwt

I tried this 4 weeks ago with the GAS PHP library – basically as describe in the G+ posting mentioned by Julien above. I was indeed able to get a token and work with it, but as soon as it expired I was not able to get a refresh token. Maybe it was me. I would really be happy to get a feedback here, whether anybody managed to get Service Account tokens working and also to refresh them after one hour.

In python you could do something like this:   (this is untested code, i just ripped bits and pieces from one of my projects)

when the user logs in with his google_id, you store his credentials. When you are ready to execute, you retrieve the credentials to execute your script.
when the token is expired, the google library from python will refresh it for you.

In your handlers:

from oauth2client.appengine import oauth2decorator_from_clientsecrets

decorator = oauth2decorator_from_clientsecrets(
    client_secrets,
    scope=[
        'https://www.googleapis.com/auth/drive',
        'https://www.googleapis.com/auth/documents',
        'https://spreadsheets.google.com/feeds',
        'https://www.googleapis.com/auth/userinfo.email'
    ], message=missing_client_secrets_message)


class LoginHandler(RestHandler):
    @decorator.oauth_required
    def get(self):
        # store the user credentials so it can be used in deferred jobs
        storage = StorageByKeyName(CredentialsModel, google_user.user_id(), 'credentials')
        storage.put(decorator.credentials)
        print 'stored new credentials: ', decorator.credentials.to_json()


and then from the place where you want to execute a script:


from googleapiclient.discovery import build
import httplib2

def execute_script(google_user_id)
    storage = StorageByKeyName(CredentialsModel, google_user_id, 'credentials')
    credentials = storage.get()
    http = httplib2.Http(timeout=15)
    credentials.authorize(http)
    script_service = build('script', 'v1', http=http)
    script_id = 'M-V25Ed...............GSi'
    body = {'function': function,
            'parameters': parameters}
    response = script_service.scripts().run(body=body, scriptId=script_id).execute()

One workaround would be to have some "control message cells" that you manipulate from PHP or Python (like with http://karl.kranich.org/2016/01/16/sheets-api-access-with-php-part-4-editing-cells/) and then have Google Apps script triggers that watch for that and run your GAS.

Using the flow for Installed Applications only requires user interaction the very first time (and should the permissions are revoked), after that no user interaction is required. I find this to be sufficient for most scenarios.

we also did  workaround in permissioning one user with access to the desired spreadsheets to our webapp, and then just use this refresh token. Its a ugly hack and i would love to use service account instead...