This guide explains how to set up and use a service account to access the
[Google Chat API](https://developers.google.com/workspace/chat/api/reference/rest)
on behalf of a Chat app. First,
it walks you through how to create a service account. Then, it demonstrates how
to write a script that uses the service account to authenticate with the Chat
API and post a message in a Chat space.

When authenticated with a service account, to get data about or perform actions
in a Chat space, Chat apps must have membership in
the space. For example, to list members of a space, or to create a message in a
space, the Chat app has to itself be a member of the
space. The only exception is when a Chat apps creates a space
with app authentication, in which case the app creates the space and then
automatically becomes a member.

Google Chat API methods that support app authorization with authorization scopes
that have names that begin `https://www.googleapis.com/auth/chat.app.*` require
one-time [administrator approval](https://support.google.com/a?p=chat-app-auth).
Google Chat API methods that support app authorization with the
`https://www.googleapis.com/auth/chat.bot` authorization scope don't require
additional approval.

If your Chat app needs to access user data or perform
actions on a user's behalf,
[authenticate as a user](https://developers.google.com/workspace/chat/authenticate-authorize-chat-user)
instead. If you're a domain administrator, you can grant domain-wide delegation
of authority to authorize a Chat app's service account
to access your user's data without requiring each user to give consent. For
more information, see
[Authenticate and authorize using domain-wide delegation](https://developers.google.com/workspace/chat/authenticate-authorize-chat-user#domain-wide-delegation).

To learn more about when Chat apps require authentication and
what kind of authentication to use, see
[Types of required authentication](https://developers.google.com/workspace/chat/authenticate-authorize#types_of_required_authentication)
in the Chat API authentication and authorization overview.

## Prerequisites

<br />

### Java

- [JDK](https://openjdk.org/install) 1.7 or greater
- The [Maven](https://maven.apache.org/) package management tool
- An initialized Maven project. To initialize a new project, run the following command in your command-line interface:

  ```java
  mvn archetype:generate -DgroupId=com.google.chat.app.authsample -DartifactId=auth-sample-app -DarchetypeArtifactId=maven-archetype-quickstart -DarchetypeVersion=1.4 -DinteractiveMode=false
  ```
- A Google Chat app that receives and responds to [user interactions](https://developers.google.com/workspace/chat/receive-respond-interactions). To create an interactive Chat app using an HTTP service, complete this [quickstart](https://developers.google.com/workspace/chat/quickstart/gcf-app).
- Add the Chat app to a space. To add the Chat app, see [Test interactive features for Google Chat apps](https://developers.google.com/workspace/chat/test-interactive-features).

### Python

- Python 3.6 or greater
- The [pip](https://pypi.python.org/pypi/pip) package management tool
- A Google Chat app that receives and responds to [user interactions](https://developers.google.com/workspace/chat/receive-respond-interactions). To create an interactive Chat app using an HTTP service, complete this [quickstart](https://developers.google.com/workspace/chat/quickstart/gcf-app).
- Add the Chat app to a space. To add the Chat app, see [Test interactive features for Google Chat apps](https://developers.google.com/workspace/chat/test-interactive-features).

### Node.js

- [Node.js 14 or greater](https://nodejs.org/en/download)
- The [npm](https://docs.npmjs.com/getting-started/installing-node#1-install-nodejs--npm) package management tool
- An initialized Node.js project. To initialize a new project, create and switch into a new folder, then run the following command in your command-line interface:

  ```javascript
  npm init
  ```
- A Google Chat app that receives and responds to [user interactions](https://developers.google.com/workspace/chat/receive-respond-interactions). To create an interactive Chat app using an HTTP service, complete this [quickstart](https://developers.google.com/workspace/chat/quickstart/gcf-app).
- Add the Chat app to a space. To add the Chat app, see [Test interactive features for Google Chat apps](https://developers.google.com/workspace/chat/test-interactive-features).

### Apps Script

- A Google Chat app that receives and responds to [user interactions](https://developers.google.com/workspace/chat/receive-respond-interactions). To create an interactive Chat app in Apps Script, complete this [quickstart](https://developers.google.com/workspace/chat/quickstart/apps-script-app).
- Add the Chat app to a space. To add the Chat app, see [Test interactive features for Google Chat apps](https://developers.google.com/workspace/chat/test-interactive-features).

## Step 1: Create a service account in Google API Console

Create a service account that your Chat app can use to
access Google APIs.

### Create a service account

To create a service account, follow these steps:

### Google Cloud Console

1. In the Google Cloud Console, go to Menu \> **IAM \& Admin** \> **Service Accounts** .

   [Go to Service Accounts](https://console.developers.google.com/iam-admin/serviceaccounts)

   The remaining steps appear in the Google Cloud Console.
2. Select a Google Cloud project.
3. Click **Create service account**.
4. Enter a service account name to display in the Google Cloud Console.

   > [!NOTE]
   > Note: By default, Google creates a unique service account ID based on the service account name. You can modify the ID in the service account ID field. You cannot change the ID later.

5. If you don't want to set access controls now, click **Done** to finish creating the service account. To set access controls now, click **Create and continue** and proceed to the next step.

   > [!NOTE]
   > **Note:** Granting access control here only affects Google Cloud resources. Google Workspace resources (such as Google Sheets and Google Drive) are shared and configured separately.

6. Optional: Assign roles to your service account to grant access to your Google Cloud project's resources in addition to Google Workspace resources. For more details, refer to [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access).
7. Click **Continue**.
8. Optional: Enter users or groups that can manage and perform actions with this service account. For more details, refer to [Service account impersonation](https://docs.cloud.google.com/iam/docs/service-account-impersonation).
9. Click **Done** to finish creating the service account.

   Make a note of the email address for the service account.

### gcloud CLI

1. Create the service account:

       gcloud iam service-accounts create `SERVICE_ACCOUNT_NAME` \
         --display-name="`SERVICE_ACCOUNT_NAME`"

2. Optional: Assign roles to your service account to grant access to your Google Cloud project's resources in addition to Google Workspace resources. For more details, refer to [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access).

The service account appears on the service account page. Next, create a private
key for the service account.

### Create a private key

> [!WARNING]
> **Warning:** This example uses an exported
> service account key for simplicity's sake. Exporting a private key is not
> recommended in production because it shouldn't be stored in an insecure
> location, such as source control.
>
> To learn more about secure service
> account implementations and best practices, see
> [Choose
> when to use service accounts](https://cloud.google.com/iam/docs/best-practices-for-using-and-managing-service-accounts#choose-when-to-use).


To create and download a private key for the service account, follow these
steps:

1. In the Google Cloud Console, go to Menu \> **IAM \& Admin** \> **Service Accounts** .

   [Go to Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)

   The remaining steps appear in the Google Cloud Console.
2. Select a Google Cloud project.
3. Click the email address of the service account that you want to create a key for.
4. Click the **Keys** tab.
5. Click the **Add key** drop-down menu, then select **Create new key**.
6. Select **JSON** as the **Key type** and click **Create** .

   Your new public/private key pair is generated and downloaded to your
   machine as a service account key file. Save the downloaded JSON file as `credentials.json`
   in your working directory. This file is the only copy of this key. After you
   download the key file, you cannot download it again. For information about how to store
   your key securely, see
   [Best practices for managing service account keys](https://docs.cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys).

For more information about service accounts, see
[service accounts](https://cloud.google.com/iam/docs/service-accounts)
in the Google Cloud IAM documentation.

Next, create a
Google Workspace Marketplace-compatible OAuth client for this service account.

### Receive administrator approval

To use the `https://www.googleapis.com/auth/chat.bot` authorization scope,
no administrator approval is required. Go to
[Step 2: Install the Google client library and other
dependencies](https://developers.google.com/workspace/chat/authenticate-authorize-chat-app#step_2_install_the_google_client_library_and_other_dependencies).
The example in this guide uses the `https://www.googleapis.com/auth/chat.bot`
authorization scope, so if you are following the example, go to step 2.

To use an authorization scope that begins with
`https://www.googleapis.com/auth/chat.app.*`, your
Chat app must get a one-time
[administrator approval](https://support.google.com/a?p=chat-app-auth).

To receive administrator approval, complete the following steps for your
Chat app:

- Create a Google Workspace Marketplace-compatible OAuth client for the service account.
- Configure the app in the Google Workspace Marketplace SDK.
- Publish the app to the Marketplace. Private visibility is sufficient for internal Chat apps.

#### Create a Google Workspace Marketplace-compatible OAuth client

To create a Google Workspace Marketplace-compatible OAuth client, follow these
steps:

1. In the Google API Console, go to Menu

   \> **IAM \& Admin**
   \> **Service Accounts**.

   [Go to Service Accounts](https://console.developers.google.com/iam-admin/serviceaccounts)
2. Click the service account you created for your
   Chat app.

3. Click **Advanced settings**.

4. Click **Create Google Workspace Marketplace-compatible OAuth client**.

5. Click **Continue**.

A confirmation message appears that says a
Google Workspace Marketplace-compatible OAuth client has been created.

#### Configure the Chat app in the Google Workspace Marketplace SDK

To configure the Chat app in the
Google Workspace Marketplace SDK, follow these steps:

1. In the Google API Console, enable the Google Workspace Marketplace SDK.

   [Enable the Google Workspace Marketplace SDK](https://console.developers.google.com/flows/enableapi?apiid=appsmarket-component.googleapis.com)
2. In the Google API Console, go to go to
   **Menu**
   \> **APIs \& Services**
   \> **Enabled APIs \& services**
   \> **Google Workspace Marketplace SDK**
   \> **App Configuration**.

   [Go to App Configuration](https://console.developers.google.com/apis/api/appsmarket-component.googleapis.com/googleapps_sdk)
3. Complete the App Configuration page. How you configure your
   Chat app depends on who your intended audience is
   and other factors. For help completing the app configuration page, see
   [Configure your app in the Google Workspace Marketplace SDK](https://developers.google.com/workspace/marketplace/enable-configure-sdk).
   For the purposes of this guide, enter the following information:

   1. Under **App visibility** , select **Private**.
   2. Under **Installation settings** , select **Individual + admin install**.
   3. Under **App integrations** , select **Chat app**.
   4. Under **OAuth scopes** , enter all the
      [authentication scopes](https://developers.google.com/workspace/chat/authenticate-authorize#chat-api-scopes)
      your Chat app uses.

      > [!WARNING]
      > **Warning:** Don't enter the `https://www.googleapis.com/auth/chat.bot` authorization scope, which doesn't require configuration on this page. Since the example in this guide uses the `https://www.googleapis.com/auth/chat.bot` authorization scope, to run the example, you don't need to enter anything here.

   5. Under **Developer information** , enter your **Developer name** ,
      **Developer website URL** , and **Developer email**.

   6. Click **Save draft**.

#### Publish the Chat app

Saving a draft on the **App Configuration** page doesn't make your
Chat app available for administrator installation. An
unpublished draft doesn't appear in the Marketplace
apps list in the Google Admin console.

Before an administrator can grant approval, complete the **Store Listing** page
and [publish your app](https://developers.google.com/workspace/marketplace/create-listing#publish-app). For
internal Chat apps, **Private** visibility publishes your app
within your Google Workspace organization right away without Google
review.

#### Get administrator approval

After you publish your Chat app, ask a
Google Workspace administrator to install the app and grant one-time
approval by following the steps in [Set up app authorization for
Chat](https://support.google.com/a?p=chat-app-auth).

> [!NOTE]
> **Note:** Adding or trusting an OAuth client ID under **App access control** in the Admin console applies only to user-authorized OAuth scopes. It doesn't grant app-level `chat.app.*` permissions to a service account.

## Step 2: Install the Google client library and other dependencies

Install the Google client library and other dependencies required for the
project.

### Java

To add the Google client libraries and other required dependencies to your
Maven project, edit the file `pom.xml` in your project's directory and add the
following dependencies:

    <dependencies>
      <!-- ... existing dependencies ... -->
      <dependency>
        <groupId>com.google.apis</groupId>
        <artifactId>google-api-services-chat</artifactId>
        <version>v1-rev20230905-2.0.0</version>
      </dependency>
      <dependency>
        <groupId>com.google.auth</groupId>
        <artifactId>google-auth-library-oauth2-http</artifactId>
        <version>1.19.0</version>
      </dependency>
      <dependency>
          <groupId>com.google.code.gson</groupId>
          <artifactId>gson</artifactId>
          <version>2.10.1</version>
      </dependency>
    </dependencies>

### Python

If you haven't already installed the Google client libraries for Python, run
the following command in your command-line interface:

    pip3 install --upgrade google-api-python-client google-auth

### Node.js

To add the Google client libraries to your Node.js project, switch into your
project's directory and run the following command in your command-line
interface:

    npm install "@googleapis/chat"

### Apps Script

This sample uses the
[OAuth2 for Apps Script library](https://github.com/googleworkspace/apps-script-oauth2)
to generate a JWT token for service account authentication. To add the library
to your Apps Script project:

1. At the left, click **Editor** .
2. At the left, next to **Libraries** , click **Add a library** .
3. Enter the script ID `1B7FSrk5Zi6L1rSxxTDgDEUsPzlukDsi4KGuTMorsTQHhGBzBkMun4iDF`.
4. Click **Look up** , then click **Add**.

This sample uses the
[Advanced Chat service](https://developers.google.com/apps-script/advanced/chat)
to call Google Chat API. To turn on the service for your
Apps Script project:

1. At the left, click **Editor** .
2. At the left, next to **Services** , click **Add a service** .
3. Select **Google Chat API**.
4. In **Version** , select **v1**.
5. Click **Add**.

You can use any language supported by our
[client libraries](https://developers.google.com/api-client-library).

## Step 3: Write a script that uses the service account to authenticate with Chat API

The following code authenticates with the
[Chat API](https://developers.google.com/workspace/chat/api/reference/rest) using a service
account, then posts a message to a Chat space:

> [!NOTE]
> **Note:** To try a sample that authenticates with a `https://www.googleapis.com/auth/chat.app.*` authorization scope, see [Create a space as a Chat app](https://developers.google.com/workspace/chat/create-spaces#create-named-app-auth).

### Java

1. In your project's directory, open the file `src/main/java/com/google/chat/app/authsample/App.java`.
2. Replace the contents in `App.java` with the following code:

       package com.google.chat.app.authsample;

       import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
       import com.google.api.client.http.HttpRequestInitializer;
       import com.google.api.client.json.gson.GsonFactory;
       import com.google.api.services.chat.v1.HangoutsChat;
       import com.google.api.services.chat.v1.model.Message;
       import com.google.auth.http.HttpCredentialsAdapter;
       import com.google.auth.oauth2.GoogleCredentials;

       /**
        * Authenticates with Chat API using service account credentials,
        * then creates a Chat message.
        */
       public class App {
           // Specify required scopes.
           private static final String CHAT_SCOPE = "https://www.googleapis.com/auth/chat.bot";

           // Specify service account details.
           private static final String PRIVATE_KEY_RESOURCE_URI = "/credentials.json";

           public static void main( String[] args ) {
               try {
                   // Run app.
                   Message response = App.createChatMessage();
                   // Print details about the created message.
                   System.out.println(response);
               } catch (Exception e) {
                   e.printStackTrace();
               }
           }

           private static Message createChatMessage() throws Exception {
               // Build the Chat API client and authenticate with the service account.
               GoogleCredentials credentials = GoogleCredentials.fromStream(
                   App.class.getResourceAsStream(PRIVATE_KEY_RESOURCE_URI))
                   .createScoped(CHAT_SCOPE);
               HttpRequestInitializer requestInitializer = new HttpCredentialsAdapter(credentials);
               HangoutsChat chatService = new HangoutsChat.Builder(
                   GoogleNetHttpTransport.newTrustedTransport(),
                   GsonFactory.getDefaultInstance(),
                   requestInitializer)
                   .setApplicationName("auth-sample-app")
                   .build();

               // The space to create the message in.
               //
               // Replace SPACE_NAME with a space name.
               // Obtain the space name from the spaces resource of Chat API,
               // or from a space's URL.
               String spaceName = "spaces/SPACE_NAME";

               // Create a Chat message.
               Message message = new Message().setText("Hello, world!");
               return chatService.spaces().messages().create(spaceName, message).execute();
           }
       }

3. In the code, replace `SPACE_NAME` with a space
   name, which you can obtain from the [`spaces.list`](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces/list)
   method in Chat API, or from a space's URL.

4. Create a new subdirectory named `resources` within your project's directory.

5. Make sure that the private key file for your service account is named
   `credentials.json` and copy it to the `resources` subdirectory.

6. To configure Maven to include the private key file in the project
   package,
   edit the file `pom.xml` in your project's directory and add the following
   configuration to the `<build>` section:

       <build>
         <!-- ... existing configurations ... -->
         <resources>
           <resource>
             <directory>resources</directory>
           </resource>
         </resources>
       </build>

7. To configure Maven to include the dependencies in the project package and
   to execute your application's main class, edit the file `pom.xml` in your
   project's directory and add the following configuration to the
   `<plugins>` section:

       <plugins>
         <!-- ... existing configurations ... -->
         <plugin>
           <artifactId>maven-assembly-plugin</artifactId>
           <configuration>
             <archive>
               <manifest>
                 <mainClass>com.google.chat.app.authsample.App</mainClass>
               </manifest>
             </archive>
             <descriptorRefs>
               <descriptorRef>jar-with-dependencies</descriptorRef>
             </descriptorRefs>
           </configuration>
         </plugin>
       </plugins>

### Python

1. In your working directory, create a file named `chat_app_auth.py`.
2. Include the following code in `chat_app_auth.py`:

       from apiclient.discovery import build
       from google.oauth2 import service_account

       # Specify required scopes.
       SCOPES = ['https://www.googleapis.com/auth/chat.bot']

       # Specify service account details.
       creds = service_account.Credentials.from_service_account_file(
           'credentials.json', scopes=SCOPES)

       # Build the URI and authenticate with the service account.
       chat = build('chat', 'v1', credentials=creds)

       # Create a Chat message.
       result = chat.spaces().messages().create(

           # The space to create the message in.
           #
           # Replace SPACE_NAME with a space name.
           # Obtain the space name from the spaces resource of Chat API,
           # or from a space's URL.
           parent='spaces/SPACE_NAME',

           # The message to create.
           body={'text': 'Hello, world!'}

       ).execute()

       # Prints details about the created message.
       print(result)

3. In the code, replace `SPACE_NAME` with a space
   name, which you can obtain from the [`spaces.list`](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces/list)
   method in Chat API, or from a space's URL. Make sure that the
   private key file for your service account is named `credentials.json`.

### Node.js

1. In your project's directory, create a file named `chat_app_auth.js`.
2. Include the following code in `chat_app_auth.js`:

       const chat = require('@googleapis/chat');

       async function createMessage() {
         const auth = new chat.auth.GoogleAuth({

           // Specify service account details.
           keyFilename: 'credentials.json',

           // Specify required scopes.
           scopes: ['https://www.googleapis.com/auth/chat.bot']

         });
         const authClient = await auth.getClient();

         // Create the Chat API client and authenticate with the service account.
         const chatClient = await chat.chat({
           version: 'v1',
           auth: authClient
         });

         // Create a Chat message.
         const result = await chatClient.spaces.messages.create({

           // The space to create the message in.
           //
           // Replace SPACE_NAME with a space name.
           // Obtain the space name from the spaces resource of Chat API,
           // or from a space's URL.
           parent: 'spaces/SPACE_NAME',

           // The message to create.
           requestBody: { 'text': 'Hello, world!' }

         });
         return result;
       }

       // Execute function then print details about the created message.
       createMessage().then(console.log);

3. In the code, replace `SPACE_NAME` with a space
   name, which you can obtain from the [`spaces.list`](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces/list)
   method in Chat API, or from a space's URL. Make sure that the
   private key file for your service account is named `credentials.json`.

### Apps Script

1. In the Apps Script editor, edit the file `appsscript.json`
   and add the OAuth scope necessary to make external requests to obtain the
   service account OAuth token:

         "oauthScopes": [
           "https://www.googleapis.com/auth/script.external_request"
         ]

2. Save the following code in a file named `ChatAppAuth.gs` in
   your Apps Script project:

       // Specify the contents of the file credentials.json.
       const CREDENTIALS = CREDENTIALS;

       const SCOPE = 'https://www.googleapis.com/auth/chat.bot';

       // The space to create the message in.
       //
       // Replace SPACE_NAME with a space name.
       // Obtain the space name from the spaces resource of Chat API,
       // or from a space's URL.
       const PARENT = 'spaces/SPACE_NAME'

       /**
        * Authenticates with Chat API using app credentials, then posts a message.
        */
       function createMessageWithAppCredentials() {
         try {
           const service = getService_();
           if (!service.hasAccess()) {
             console.error(service.getLastError());
             return;
           }

           // Specify the message to create.
           const message = {'text': 'Hello world!'};

           // Call Chat API with a service account to create a message.
           const result = Chat.Spaces.Messages.create(
               message,
               PARENT,
               {},
               // Authenticate with the service account token.
               {'Authorization': 'Bearer ' + service.getAccessToken()});

           // Log details about the created message.
           console.log(result);

         } catch (err) {
           // TODO (developer) - Handle exception.
           console.log('Failed to create message with error %s', err.message);
         }
       }

       /**
        * Configures the OAuth library to authenticate with the service account.
        */
       function getService_() {
         return OAuth2.createService(CREDENTIALS.client_email)
             .setTokenUrl('https://oauth2.googleapis.com/token')
             .setPrivateKey(CREDENTIALS.private_key)
             .setIssuer(CREDENTIALS.client_email)
             .setSubject(CREDENTIALS.client_email)
             .setScope(SCOPE)
             .setPropertyStore(PropertiesService.getScriptProperties());
       }

3. In the code, replace `CREDENTIALS` with the
   contents of the file `credentials.json`.

4. In the code, replace `SPACE_NAME` with a space
   name, which you can obtain from the [`spaces.list`](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces/list)
   method in Chat API, or from a space's URL.

## Step 4: Run the complete example

In your working directory, build and run the sample:

### Java

    mvn compile assembly:single
    java -jar target/auth-sample-app-1.0-SNAPSHOT-jar-with-dependencies.jar

### Python

    python3 chat_app_auth.py

### Node.js

    node chat_app_auth.js

### Apps Script

Open the file `ChatAppAuth.gs` in the Apps Script Editor and
click **Run**.

Your script makes an authenticated request to the
[Chat API](https://developers.google.com/workspace/chat/api/reference/rest), which responds by
posting a message in a Chat space as a
Chat app.

## Troubleshoot the example

This section describes common issues that you might encounter while attempting
to run this sample.

### You are not permitted to use this app

When running the script, you might receive an error that says:

    <HttpError 403 when requesting https://chat.googleapis.com/v1/spaces/{space}/messages?alt=json returned "You are not permitted to use this app". Details: "You are not permitted to use this app">

This error message means that the Chat app doesn't have
permission to create Chat messages in the specified
Chat space.

To resolve the error, [add the Chat app to the Chat space](https://support.google.com/chat/answer/7653881)
specified in the script.

### The administrator must grant the app the required OAuth authorization scope for this action

When running the script, you might receive an error that says:

    <HttpError 403 when requesting https://chat.googleapis.com/v1/spaces/{space}?alt=json returned "The administrator must grant the app the required OAuth authorization scope for this action.". Details: "The administrator must grant the app the required OAuth authorization scope for this action.">

This error message means that a Google Workspace administrator hasn't
yet granted one-time approval to the Chat app to use
authorization scopes that begin with the name
`https://www.googleapis.com/auth/chat.app.*`.

To resolve the error:

- Verify that you completed the **Store Listing** page and [published your app](https://developers.google.com/workspace/marketplace/create-listing#publish-app) to the Marketplace. Unpublished drafts don't appear in the Admin console for installation.
- Ask the Google Workspace administrator to grant approval to your Chat app by following [Set up app authorization for
  Chat](https://support.google.com/a?p=chat-app-auth). Trusting an OAuth client ID in **App access control** doesn't grant `chat.app.*` scopes. When handling this error in your Chat app logic, consider [sending a message](https://developers.google.com/workspace/chat/create-messages) announcing that the Chat app needs administrator approval: `To perform this action, I need approval.
  <https://support.google.com/a?p=chat-app-auth|Learn more>.`
- If the Chat API method supports the `https://www.googleapis.com/auth/chat.bot` authorization scope, which doesn't require administrator approval, consider using it instead. To check which authorization scopes a method supports, see the [Chat API reference documentation](https://developers.google.com/workspace/chat/api-overview).

### Email aliases aren't supported with app authentication

When calling methods such as `spaces.findDirectMessage` with app
authentication, passing an email alias like `users/sasha@example.com` returns
an HTTP `403` error:

    Service account authentication doesn't support access to user information
    using email aliases. To get user information using email aliases,
    authenticate as a user.

With service account authentication, specify a numeric user ID in the format
`users/{user}` instead of an email address. You can get this numeric ID from
the `User.name` field in a Chat interaction event, the
People API, or the Directory API. For details, see
[Specify a user in a call to the
Chat API](https://developers.google.com/workspace/chat/identify-reference-users#specify-user).

## Related topics

- Learn what else Chat API can do by reviewing the Chat API [reference documentation](https://developers.google.com/workspace/chat/api/reference/rest).
- If using an OAuth authorization scopes that begins with `https://www.googleapis.com/auth/chat.app.*`, learn how [administrators grant one-time approval](https://support.google.com/a?p=chat-app-auth).