Google Analytics API Error: Request had invalid authentication credentials.

[icreatestuff]

Describe the bug

We successfully set up Google Analytics source and connected the site to it and then setup a dashboard using that source. This worked for about a week but we now get an internal server error when viewing the dashboard.

The Metrix logs indicate the following:

2025-05-29 17:09:10 [ERROR] Google Analytics: API error: “{
  "error": {
    "code": 401,
    "message": "Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
    "status": "UNAUTHENTICATED"
  }
}
” /home/html/placeholder-domain.com/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php:111
2025-05-29 17:09:10 [ERROR] #0 /home/html/placeholder-domain.com/vendor/guzzlehttp/guzzle/src/Middleware.php(72): GuzzleHttp\Exception\RequestException::create()
#1 /home/html/placeholder-domain.com/vendor/guzzlehttp/promises/src/Promise.php(209): GuzzleHttp\Middleware::GuzzleHttp\{closure}()
#2 /home/html/placeholder-domain.com/vendor/guzzlehttp/promises/src/Promise.php(158): GuzzleHttp\Promise\Promise::callHandler()
#3 /home/html/placeholder-domain.com/vendor/guzzlehttp/promises/src/TaskQueue.php(52): GuzzleHttp\Promise\Promise::GuzzleHttp\Promise\{closure}()
#4 /home/html/placeholder-domain.com/vendor/guzzlehttp/promises/src/Promise.php(251): GuzzleHttp\Promise\TaskQueue->run()
#5 /home/html/placeholder-domain.com/vendor/guzzlehttp/promises/src/Promise.php(227): GuzzleHttp\Promise\Promise->invokeWaitFn()
#6 /home/html/placeholder-domain.com/vendor/guzzlehttp/promises/src/Promise.php(272): GuzzleHttp\Promise\Promise->waitIfPending()
#7 /home/html/placeholder-domain.com/vendor/guzzlehttp/promises/src/Promise.php(229): GuzzleHttp\Promise\Promise->invokeWaitList()
#8 /home/html/placeholder-domain.com/vendor/guzzlehttp/promises/src/Promise.php(69): GuzzleHttp\Promise\Promise->waitIfPending()
#9 /home/html/placeholder-domain.com/vendor/guzzlehttp/guzzle/src/Client.php(124): GuzzleHttp\Promise\Promise->wait()
#10 /home/html/placeholder-domain.com/vendor/league/oauth2-client/src/Provider/AbstractProvider.php(706): GuzzleHttp\Client->send()
#11 /home/html/placeholder-domain.com/vendor/verbb/auth/src/base/ProviderTrait.php(132): League\OAuth2\Client\Provider\AbstractProvider->getResponse()
#12 /home/html/placeholder-domain.com/vendor/verbb/auth/src/base/ProviderTrait.php(152): verbb\auth\providers\Google->getApiRequest()
#13 /home/html/placeholder-domain.com/vendor/verbb/auth/src/base/OAuthProviderTrait.php(247): verbb\auth\providers\Google->getApiRequest()
#14 /home/html/placeholder-domain.com/vendor/verbb/metrix/src/sources/GoogleAnalytics.php(265): verbb\metrix\base\OAuthSource->request()
#15 [internal function]: verbb\metrix\sources\GoogleAnalytics->verbb\metrix\sources\{closure}()
#16 /home/html/placeholder-domain.com/vendor/yiisoft/yii2/caching/Cache.php(608): call_user_func()
#17 /home/html/placeholder-domain.com/vendor/verbb/metrix/src/sources/GoogleAnalytics.php(263): yii\caching\Cache->getOrSet()
#18 /home/html/placeholder-domain.com/vendor/verbb/metrix/src/sources/GoogleAnalytics.php(170): verbb\metrix\sources\GoogleAnalytics->_getPropertyMetadata()
#19 /home/html/placeholder-domain.com/vendor/verbb/metrix/src/base/Source.php(169): verbb\metrix\sources\GoogleAnalytics->fetchAvailableMetrics()
#20 /home/html/placeholder-domain.com/vendor/verbb/metrix/src/base/Widget.php(126): verbb\metrix\base\Source->getAvailableMetrics()
#21 /home/html/placeholder-domain.com/vendor/verbb/metrix/src/base/Widget.php(154): verbb\metrix\base\Widget->getMetricLabel()
#22 /home/html/placeholder-domain.com/vendor/verbb/metrix/src/services/Widgets.php(116): verbb\metrix\base\Widget->getFrontEndData()
#23 /home/html/placeholder-domain.com/vendor/verbb/metrix/src/controllers/DashboardController.php(51): verbb\metrix\services\Widgets->getWidgetsForView()
#24 [internal function]: verbb\metrix\controllers\DashboardController->actionIndex()
#25 /home/html/placeholder-domain.com/vendor/yiisoft/yii2/base/InlineAction.php(57): call_user_func_array()
#26 /home/html/placeholder-domain.com/vendor/yiisoft/yii2/base/Controller.php(178): yii\base\InlineAction->runWithParams()
#27 /home/html/placeholder-domain.com/vendor/yiisoft/yii2/base/Module.php(552): yii\base\Controller->runAction()
#28 /home/html/placeholder-domain.com/vendor/craftcms/cms/src/web/Application.php(348): yii\base\Module->runAction()
#29 /home/html/placeholder-domain.com/vendor/yiisoft/yii2/web/Application.php(103): craft\web\Application->runAction()
#30 /home/html/placeholder-domain.com/vendor/craftcms/cms/src/web/Application.php(316): yii\web\Application->handleRequest()
#31 /home/html/placeholder-domain.com/vendor/yiisoft/yii2/base/Application.php(384): craft\web\Application->handleRequest()
#32 /home/html/placeholder-domain.com/web/index.php(12): yii\base\Application->run()
#33 {main}

Neither the Client ID, Secret or any of the available APIs have been altered.

If I disconnect and reconnect the source again, I'm prompted to log in to my Google account, after which the dashboard comes back.
It's almost like its connect to my Google Account login session rather than a long-lived session using the Client ID and Secret.

Any ideas what might be going on?

Thanks

Steps to reproduce

1. Setup a Google Analytics source following the instructions here https://verbb.io/craft-plugins/metrix/docs/providers/google-analytics
2. Connect and authorise the site
3. Setup a dashboard using widgets powered by the Google Analytics source
4. Wait a while (week?), and revisit the the dashboard.

Craft CMS version

4.15.4

Plugin version

1.0.1

Multi-site?

No response

Additional context

No response

[engram-design]

Interesting, that's not an error I've come across before. I can confirm my test dashboards are showing live data well after a week since I last checked them without touching anything. Indeed, it seems like the refresh token isn't working.

To confirm you are actually getting a refresh token, take a look in your auth_oauth_tokens database table, and track down a row with the ownerHandle = metrix and providerType = verbb\metrix\sources\GoogleAnalytics. Take a look at the refreshToken column to ensure that you actually have a value for that.

You can look at the expires column, but that'll typically be 1 hour from the last successful auth.

[icreatestuff]

Hey @engram-design, thanks for the instructions. I've checked and there is a refreshToken set for that record. I'll give it a week and come back to you if I notice the same issue so we can debug further.

[icreatestuff]

Hi @engram-design just to let you know this issue occured again. When I look at the record in the auth_oauth_tokens table I can see that there is a refreshToken set and that the dateUpdated is different to the dateCreated by a few days, so it looks like it has updated with a new token at least once, probably more, but then stops. The record was created on the 29th May, and last updated on the 3rd June. The 'expires' column gives a timestamps that translates to 10:19 on the 3rd June (1 hour after the record was updated).

Is the token being refreshed in a background task? I wonder if the queue isn't being processed regularly enough if it's only being run when there's activity in the control panel?

[engram-design]

Thanks for confirming all that, that all seems to be normal. The 1 hour after is normal, and tokens should be automatically refreshed next time they're tried to be used, or the current time is over the expires time.

We don't actively refresh the token around the clock, although that's an interesting idea. I'm not sure if that'll just cause more issues though, with refreshing too many times even if we were to implement that.

Just checking this isn't a service account or anything? I don't actually see any other settings in Google that could change the behaviour of tokens either...

[engram-design]

Also worth running this from your CLI as a diagnosis...

  curl -X POST https://oauth2.googleapis.com/token \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "refresh_token=YOUR_REFRESH_TOKEN" \
  -d "grant_type=refresh_token"

Replace the client keys from your provider settings, and get the refresh token from the auth_oauth_tokens database table. Should be a row in there with ownerHandle = 'metrix' and providerType = verbb\metrix\sources\GoogleAnalytics. You're after the refreshToken column value.