Chrome Extension: Google Photos API Returns "Insufficient Scopes" Despite Correct Setup

I’m building a Chrome extension that integrates with Google Photos API, but I keep hitting a 403 PERMISSION_DENIED error with the message: "Request had insufficient authentication scopes"

What Works

• Google Calendar API requests succeed with the same auth flow (calendar.readonly scope works perfectly).
• The OAuth token is obtained successfully.
• The extension has the correct scopes declared in manifest.json.

What I’ve Tried

Manifest.json Configuration:

"scopes": [
    "https://www.googleapis.com/auth/calendar.readonly",
    "https://www.googleapis.com/auth/photoslibrary.readonly",
    "https://www.googleapis.com/auth/photoslibrary"
  ]

1. Enabled Google Photos Library API in Google Cloud Console.
2. Added Test Users to OAuth consent screen (app is in "Testing" mode).

API Endpoints Tested:

3. https://photoslibrary.googleapis.com/v1/mediaItems

4. https://photoslibrary.googleapis.com/v1/mediaItems:search

Screenshots:

Why does the same token work for Calendar API but fail for Photos API?

Why does the Photos API claim "insufficient scopes" when the token includes them?

Has anyone successfully used Google Photos API in a Chrome extension? Are there hidden requirements or quota limits I’m missing?

the scope photoslibrary.readonly、photoslibrary has been deprecated and will be removed after March 31, 2025.

After this date, any API calls using only this scope will return a 403 PERMISSION_DENIED error.

What should you do?

For reading photos, use the https://www.googleapis.com/auth/photoslibrary.readonly.appcreateddata scope.

For other use cases, review the latest Google Photos API documentation for supported scopes and migration instructions.

Reference:

https://developers.google.com/photos/support/updates#affected-scopes-methods