My web application is integrating with Google Picker.

I have separated flow for user to link their email account with scope "https://www.googleapis.com/auth/drive.file" and stored the user OAuth Token. The access token is then used to load Google Picker. I have the handling to refresh access token before it expiry.

Here the code snippet

  createPicker(accessToken) {
    if (pickerApiLoaded && oAuthToken) {
      let view = new window.google.picker.View(window.google.picker.ViewId.DOCS);
      let picker = new window.google.picker.PickerBuilder()
        .enableFeature(window.google.picker.Feature.MULTISELECT_ENABLED)
        .setAppId(appConfigs.googleAppId)
        .setOAuthToken(accessToken)
        .addView(view)
        .addView(new window.google.picker.DocsUploadView())
        .setDeveloperKey(appConfigs.googleDeveloperKey)
        .setCallback(this.pickerCallback)
        .build();
      picker.setVisible(true);
    }
  }

Following are the scenarios I tested:

1. Using @gmail account (working)
2. Using @test.workspace.com - test workspace account (working)
3. Using @workspace.com - actual workspace account (not working)

It works on personal @gmail account and @test.workspace.com account.

However when test using real workspace account. e.g. @workspace.com. I am getting 403: insufficient permission error when using access token on Google Picker. I feel it is unlikely due to code logic. Could be some configurations at workspace side.

NOTE: i am not using the real domain here as i am not suppose to expose it here

I have limited access (managed by third party, i am vendor) to the real workspace account. Please help.