php - Google Analytics API oauth exception "invalid_grant" with Service Account. Same code on two servers. Only one works

Question

I'm querying the Analytics API via a Service Account.

I have written the code on the dev server and it works without issues. When running the same code on the production server, it throws this:

Google_AuthException: Error refreshing the OAuth2 token, message: '{ "error" : "invalid_grant" }'

I've tried creating another Service account, and the behavior is the same.

The oAuth IETF draft (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-31) says this about the error:

     invalid_grant
           The provided authorization grant (e.g. authorization
           code, resource owner credentials) or refresh token is
           invalid, expired, revoked, does not match the redirection
           URI used in the authorization request, or was issued to
           another client.

Here is the code I've written:

$GA_CLIENT_ID = 'XX.apps.googleusercontent.com';
$GA_APP_EMAIL = '[email protected]';
$GA_APP_NAME = 'XX';
$GA_KEY_FILE = 'XX';

// create client object and set app name
$client = new Google_Client();
$client->setApplicationName($GA_APP_NAME); // name of your app

// set assertion credentials
$client->setAssertionCredentials(
        new Google_AssertionCredentials(
            $GA_APP_EMAIL, // email you added to GA
            array('https://www.googleapis.com/auth/analytics.readonly'),
            file_get_contents($GA_KEY_FILE)  // keyfile you downloaded
            ));

// other settings
$client->setClientId($GA_CLIENT_ID);           // from API console

$client->setAccessType('offline_access');  // this may be unnecessary?

// create service and get data
$service = new Google_AnalyticsService($client);
$result = $service->data_ga->get($ids, $startDate, $endDate, $metrics, $optParams);
return $result;

I've also tried a solution suggested here (https://groups.google.com/forum/?fromgroups#!topic/gs-discussion/3y_2XVE2q7U%5B1-25%5D) using authenticatedRequest() instead of Google_AnalyticsService:

$req = new Google_HttpRequest($apiUrl);
$resp = $client::getIo()->authenticatedRequest($req);
$result = json_decode($resp->getResponseBody(), true);

This alternative also works on the dev server, but not on the production one.

I am totally clueless on this one. Has anyone seen this/fixed it?

Thanks!

Answer 1

Apparently the problem was the system time being off. Worked by sync-ing via NTP with:

sudo ntpdate npt.ubuntu.com

sudo ntpdate pool.ntp.org

Edit

As @RafaSashi suggested below, the pool.ntp.org server is more reliable. Use that instead of ntp.ubuntu.com (which was the first working one I tried, thus the initial choice).