Unauthorized Client or Scope in Request
Configure proper API scopes in your Google Workspace Connector.
Error Messages
Error Variant 1
unauthorized_client: Unauthorized client or scope in request.
Error Variant 2
unauthorized_client: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.
Scope Authorization Issue
Root Cause
Improper Service Account Configuration
The Google service account feeds have improper configuration settings. The required API scopes are either missing or incorrectly configured in the Google Admin Console domain-wide delegation settings.
What Are Scopes?
OAuth scopes define what data and operations the service account can access. Missing scopes means the migration tool cannot perform required operations like reading emails, calendars, or Drive files.
Solution
Configure Required API Scopes
Access Google Admin Console
Go to admin.google.com → Security → API Controls → Domain-wide Delegation.
Find Your Service Account
Locate your Cloudiway service account by its Client ID and click to edit its scope configuration.
Add Required Scopes
Add all scopes specified in the Google Workspace Connector Configuration guide, including Gmail, Calendar, and Drive scopes.
Retry Migration
Wait a few minutes for changes to propagate, then restart the migration process.