Authenticate to the Google Play Android Publisher API v3 with a Google Cloud service account and obtain a bearer token

Documented steps

1. Create or select a Google Cloud project, then enable the Google Play Android Publisher API on it (console.developers.google.com/apis/api/androidpublisher.googleapis.com).
2. In Cloud Console > IAM & Admin > Service Accounts, create a service account for publishing. Create a JSON key only if you cannot use Workload Identity Federation.
3. In Play Console > Users and permissions, click 'Invite new users' and enter the service account's email address (e.g. publisher@PROJECT.iam.gserviceaccount.com).
4. Grant that service account the app-level permissions the task actually needs (e.g. release management for a single app) rather than Admin. For the Billing/Orders APIs you additionally need 'View financial data, orders, and cancellation survey responses' and 'Manage orders and subscriptions'.
5. Mint an access token with exactly the scope https://www.googleapis.com/auth/androidpublisher using a Google auth library, gcloud, or the IAM Credentials API. Do not over-scope to cloud-platform.
6. Smoke-test the credential with an edits.insert call: curl -X POST -H "Authorization: Bearer $TOKEN" https://androidpublisher.googleapis.com/androidpublisher/v3/applications/{packageName}/edits
7. A 200 returns an AppEdit with id and expiryTimeSeconds; that confirms both the API enablement and the Play Console grant.
8. On 401, the token is missing/expired or has the wrong scope. On 403, the service account almost certainly was never invited in Play Console Users and permissions, or lacks the app-level permission for that specific package.
9. After granting or changing Play Console permissions, allow time for propagation before assuming the grant failed; retry the smoke test rather than re-creating the service account.