Google Play reviews API errors and what actually causes them

Almost always the same mistake: a service-account JWT was signed and then sent as the credential. A self-signed JWT is not an access token. It is the thing you trade for one.

Post the signed JWT to https://oauth2.googleapis.com/token with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer, then send the access_token that comes back. JWT claims: iss is the service-account email, aud is the token endpoint itself, exp no more than an hour after iat, and scope set to androidpublisher.

The token is real and Google accepted it. What is missing is the grant: your service account has not been invited as a user on the Play Console developer account that owns the app, or it was invited without the reviews permission.

Play Console, Users and permissions, invite new users, paste the service-account email. The permission you want is worded "Reply to reviews on Google Play. Change the contact information used in suggested replies." This is also how you legitimately manage a client's app: the client invites your service account to their developer account. Nothing about ownership is enforced at the API layer.

This used to mean your Cloud project needed linking to the Play Console developer account. That requirement is gone.

Check the invite before you go hunting for the linking screen. Google's getting-started page says the requirement is gone. The screen still exists in Play Console and linking still works, so it is optional rather than wrong, but it is no longer the thing standing between you and a 200. What you do need is the service account invited into Play Console with the reviews permission, which is a separate step in a separate console and the one people actually skip.

Two documented reasons, and they catch almost everyone. The endpoint only returns a one-week window, and it only covers production.

Expect an absent reviews array rather than an empty one, and code for that. For anything older than a week, use the Play Console CSV export. If you are testing against an internal or closed track, that is why you are getting nothing.

The widely accepted answer says the review was older than seven days, and the asker did report that replies to recent reviews worked while older ones failed.

Only reply to reviews that reviews.list handed you in the current window. If you are pulling review ids from anywhere else, that is the likely culprit.

The replyText ceiling, and Google stripping markup.

Keep the reply under about 350 characters and send plain text. Count before you send rather than after Google rejects it.

Third-party integration docs describe a propagation delay after inviting a service account, commonly quoted as up to 24 hours.

Wait and retry before you start rewriting your auth code, which is the usual reaction to this.

You read the wrong page. The reviews endpoints have their own quota, and it is far tighter than the Play Developer API default. Two hundred GET calls per hour is roughly one every eighteen seconds, and reviews.list pages, so a single poll of a busy app can spend several of them before you have read anything.

Budget against 200 GET per hour and 2000 POST per day, applied per app, so a multi-app account gets a separate budget on each title. Ask Google for an increase if you genuinely need one. Google does not document the error body you get when you exhaust it, so do not pattern-match on a string.