Token generation failed for service account

Google Cloud Apigee
,
1

HI Team ,

i am having below code snippet where i am trying to connect with google stotrage api:

<URL>https://storage.googleapis.com</URL>

<Authentication>

  <GoogleAccessToken>

    <Scopes>

      <Scope>

https://www.googleapis.com/auth/devstorage.read_write

                </Scope>

    </Scopes>

  </GoogleAccessToken>

</Authentication>

https://storage.googleapis.com

https://www.googleapis.com/auth/devstorage.read_write

and i am using one service account to deploy the api which sa is having token generator permission added but i am getting below error :

image
image1129×468 156 KB

need help

2

Dear @supriyokumar274, we have noted your question and will keep it on our radar to ensure you receive an answer, as we encourage our community members and experts to share their insights.

In the meantime, feel free to explore our community’s past articles on Apigee security features.

Additionally, you are invited to join us this Thursday, June 25, at 10 AM CEST for a Community TechTalk on Agent Control Through an AI Gateway; RSVP here :right_arrow: Taking agentic from pilot to production: Agent control through an AI Gateway

communitytechtalkwithappythingjune2026
communitytechtalkwithappythingjune20262500×1875 190 KB

3

@dchiesa1

6

here actually we are passing one post request to gcs bucket to upload one file into gcs and we are trying to call the gcs which is in another project and apigee is in another project and the service account we are using to deploy the proxy it is having the permission for token creator

7

still facing the same issue

8

Hi @supriyokumar274 - apologies for the delayed reply, if you are getting a token generation failed message, then generally this is because a necessary role assignment is missing, see the documentation steps here: Using Google authentication  |  Apigee  |  Google Cloud Documentation.

So you need to give an apigee service account the rights to create tokens for your service account, this is the script that I use for that:

# set your project id
GOOGLE_CLOUD_PROJECT=YOUR_PROJECT_ID
# get the project number
PROJECT_NUMBER=$(gcloud projects describe $GOOGLE_CLOUD_PROJECT --format="value(projectNumber)")
# assign token creator role to apigee
gcloud iam service-accounts add-iam-policy-binding \
  ai-service@$GOOGLE_CLOUD_PROJECT.iam.gserviceaccount.com \
  --member="serviceAccount:service-$PROJECT_NUMBER@gcp-sa-apigee.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator" --project $GOOGLE_CLOUD_PROJECT

You only have to do this once - I do it when provisioning and setting up all of my service accounts that will be used in Apigee proxies.

Hope this helps!

9

Hi ,

Thanks for the response

My service account already had token creator permission enabled al though i have changed the scope to https://www.googleapis.com/auth/cloud-platform and it worked thanks