Why does the GA4 Data/Admin API reject my service account with a permissions error even though access looks correct?
Quick answer
Enabling the Google Analytics Data API (or Admin API) in a Google Cloud project only authorizes the service account's credentials to make API calls - it does not automatically grant that service account access to any specific GA4 property. The service account's own email address (the long ...@...iam.gserviceaccount.com string) has to be added as a user under GA4 Admin > Property Access Management, with at least Viewer role, separately from the GCP-side API enablement.
Why This Happens
This is one of the most common Google API integration mistakes because it conflates two genuinely separate permission systems: GCP IAM (which governs who can call which Google Cloud APIs, billed to which project) and GA4's own property-level access list (which governs who can see or configure data inside a specific Analytics property, entirely independent of any Cloud project). A service account can have full IAM rights in its own project and zero rights inside the GA4 property it's trying to query.
A second, less common cause is querying the wrong property or account ID - the numeric GA4 property ID used in the API call (not the Measurement ID, which is a different identifier in G-XXXXXXX format) must exactly match a property the authenticated identity actually has access to, or the API returns a permissions error even when access exists on a different, similarly-named property.
Fix It
Add the service account email to the GA4 property directly
Copy the service account's client email (from its GCP JSON key, the field literally called client_email) and add it in GA4 Admin > Property Access Management > the plus icon > Add users, with Viewer role at minimum for read-only reporting calls.
Confirm you're using the property ID, not the Measurement ID
The Data/Admin API expects the numeric property ID (found in GA4 Admin > Property Settings, format like properties/123456789), not the G-XXXXXXX Measurement ID used for tagging - these are frequently swapped by mistake.
Confirm the correct API is enabled on the correct GCP project
In Google Cloud Console > APIs & Services, confirm the Google Analytics Data API (for reporting queries) or Admin API (for configuration/management calls) is enabled on the same project whose service account key you're authenticating with - enabling it on a different project does nothing for these credentials.
For write/configuration operations, check the role level
Viewer access is enough for Data API reporting queries, but Admin API write operations (creating custom dimensions, managing data streams) require Editor or Administrator role on the property for that service account.
How To Verify It Worked
Call a lightweight Admin API method first, like properties.get for the property ID in question, using the service account's credentials. A pass returns the property's metadata; a permissions error at this stage confirms the access-list issue rather than anything specific to the reporting query you were originally trying to run.
Once properties.get succeeds, retry the original Data API report request and confirm it returns row data rather than an error - if it still fails at that point, double check the exact property ID used matches the one you just successfully fetched metadata for.
Still Not Fixed?
We audit and fix GA4 implementations for a living - if this doesn't resolve it, the next step is usually a full event-by-event audit.
Talk to a GA4 Consultant