I am trying to use the Google Contacts API to connect to a user's contact information, on my Google apps domain. Generating an access_token using the gdata api's ContactsService clientlogin function while using the API key for my project works fine, but I would prefer to not store the user's credentials, and from the information I have found that method uses OAuth1.0 So, to use OAuth2.0 I have: Generated a Service Account in the developer's console for my project Granted access to the service account for the scope of https://www.google.com/m8/feeds/ in the Google apps domain admin panel Attempted to generate credentials using SignedJwtAssertionCredentials: credentials = SignedJwtAssertionCredentials( service_account_name=service_account_email, private_key=key_from_p12_file, scope='https://www.google.com/m8/feeds/', sub=user_email') The problem I am running into is that attempting to generate an access token using this method fails. It succeeds in generating the token when I remove the sub parameter, but then that token fails when I try to fetch the user's contacts. Does anyone know why this might be happening?