I am trying to use the Google Contacts API to connect to a user's contact information, on my Google apps domain.

Generating an access_token using the gdata api's ContactsService clientlogin function while using the API key for my project works fine, but I would prefer to not store the user's credentials, and from the information I have found that method uses OAuth1.0

So, to use OAuth2.0 I have:

1. Generated a Service Account in the developer's console for my project
2. Granted access to the service account for the scope of https://www.google.com/m8/feeds/ in the Google apps domain admin panel

3. Attempted to generate credentials using SignedJwtAssertionCredentials:

    credentials = SignedJwtAssertionCredentials(
                service_account_name=service_account_email, 
                private_key=key_from_p12_file, 
                scope='https://www.google.com/m8/feeds/', 
                sub=user_email')
   

The problem I am running into is that attempting to generate an access token using this method fails. It succeeds in generating the token when I remove the sub parameter, but then that token fails when I try to fetch the user's contacts.

Does anyone know why this might be happening?