Google Analytics Data API has not been used in project 12345, but I have no access to this project

Question

I'm running this code:

var auth = "Bearer " + token;
var myHeaders = {
  "Authorization": auth
}

var rawdata = JSON.stringify({
  "dimensions": [
    {
      "name": "appVersion"
    },
    {
      "name": "eventName"
    }
  ],
  "metrics": [
    {
      "name": "eventCount"
    }
  ],
  "dateRanges": [
    {
      "startDate": "30daysAgo",
      "endDate": "yesterday"
    }
  ],
  "orderBys": [
    {
      "dimension": {
        "orderType": "ALPHANUMERIC",
        "dimensionName": "appVersion"
      }
    },
    {
      "dimension": {
        "orderType": "ALPHANUMERIC",
        "dimensionName": "eventName"
      }
    }
  ],
  "metricAggregations": [
    "TOTAL"
  ]
});

var requestOptions = {
  'contentType': 'application/json',
  'headers': myHeaders,
  'method' : 'post',
  'payload' : rawdata, 
  'followRedirects': true,
   'muteHttpExceptions' : true
};

  var response = UrlFetchApp.fetch(url, requestOptions);
    Logger.log(`response is ${response}`)
   var result = JSON.parse(response.getContentText());
  var dataSet = result;
Once I had created a trigger, we saw 100% failure rate.

response is {
  "error": {
    "code": 403,
    "message": "Request had insufficient authentication scopes.",
    "status": "PERMISSION_DENIED"
  }
}

And get this error:

  "error": {
    "code": 403,
    "message": "Google Analytics Data API has not been used in project 548594456844 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/analyticsdata.googleapis.com/overview?project=548594456844 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.Help",
        "links": [
          {
            "description": "Google developers console API activation",
            "url": "https://console.developers.google.com/apis/api/analyticsdata.googleapis.com/overview?project=548594456844"
          }
        ]
      },
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "SERVICE_DISABLED",
        "domain": "googleapis.com",
        "metadata": {
          "consumer": "projects/548594456844",
          "service": "analyticsdata.googleapis.com"
        }
      }
    ]
  }
}

But I don't have access to this GCP project. Does that mean that GCP is mandatory to call GA4 API?

If I don't have access to this GCp project (default one for apps-script) - How can I fix it then?

Answer 1

Google Projects are a generic type that exist beyond e.g. Google Cloud, Firebase and other Google "Product Areas" that like to present Google through their (smaller|limited) world view.

NOTE In the old days, IIRC, these were all called API projects or similar. Sometimes it's possible to browse (e.g. a GCP project) from (e.g. a Firebase) project but there's project metadata that tends to filter projects to the Consoles from which they were created.

Corrollary: When you create a Google Cloud Platform project, you're really creating a generic Google API project that may have some extra metadata that presents the project as GCP.

A Google Project is the intersection of a set of Google APIs, a set of credentials (User|Service) Accounts and a billing account.

In this case, you will need to enable Google Analytics Data API in the project before you can use a Service Account owned by that project to call the API.

This provides not only a security but also a billing perimeter to the use of Google's APIs. In this case, the Google Analytics APIs don't appear to incur billing charges but many other Google APIs do.

If you're unable to access the project and noone with access is willing to enable the project for you, you'll be unable to use that Service Account to access Google Analytics. You may want to create another Project and a new Service Account and use that instead. I think (!?) that you won't need to enable billing to use Google Analytics Data API and thus you shouldn't need to provide e.g. a credit card.

NOTE Don't forget to add the Service Account's email addresss (${ACCOUNT}@${PROJECT}.iam.gserviceaccount.com) to your Google Analytics properties' (as many as you want to use) auth too.