Apps Script API returns 401 "invalid authentication credentials" while Drive API works with same credentials

[tjmpn2]

gws version: 0.4.4
OS: macOS (Apple Silicon, MacBook Pro)
Account type: Personal @gmail.com
Description
After authenticating with gws auth login --scopes https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/script.projects, all Google Drive API calls work correctly but all Apps Script API calls fail with 401 "invalid authentication credentials."
Steps to Reproduce

Install gws via npm: npm install -g @googleworkspace/cli
Place custom client_secret.json in ~/.config/gws/
Enable both Google Drive API and Apps Script API in GCP project
Enable Apps Script API at https://script.google.com/home/usersettings
Authenticate:

bashgws auth login --scopes https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/script.projects

Export unmasked credentials (required due to separate Keychain issue — see below):

bashgws auth export --unmasked > ~/.config/gws/credentials.json

Verify auth status shows correct scopes:

bashgws auth status

Shows scope_count: 2, token_valid: true, both drive and script.projects scopes listed

Test Drive API — works:

bashgws drive files list --params '{"pageSize": 5, "fields": "files(id,name,mimeType)"}' --format table

Returns file listing successfully

Test Apps Script API — fails:

bashgws apps-script projects getContent --params '{"scriptId": "VALID_SCRIPT_ID"}'

Returns 401 error

Expected Behavior
gws apps-script projects getContent should return the script project content, since the credentials include the script.projects scope and the Apps Script API is enabled.
Actual Behavior
json{
"error": {
"code": 401,
"message": "Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
"reason": "unknown"
}
}
Additional Context
Scope issue required revoking app access
Initially, after adding script.projects to an existing auth session, the API returned 403 "insufficient authentication scopes" even though gws auth status showed the scope was present. This was resolved by revoking app access at https://myaccount.google.com/permissions and re-authenticating from scratch. After revoking, the error changed from 403 to 401.
Separate issue: encrypted credentials not usable for API calls
On macOS, gws auth login saves encrypted credentials via OS Keyring, but API calls (e.g., gws drive files list) fail with 401 "No credentials provided" unless you first run gws auth export --unmasked > ~/.config/gws/credentials.json to create a plaintext credentials file. The gws auth status command can read the encrypted credentials fine, but the API call code path cannot. This workaround resolves Drive API calls but does not resolve the Apps Script 401.

[jpoehnelt]

are you still running into this?

[OBugroviy]

Same issue.

Update: Deleting all the stale credential and token cache files (credentials*.enc and token_cache*.json) from the ~/.config/gws/ directory and reauthorizing helps.