The Apps Script Execution API lets you call Google Apps Scripts from standard HTML pages. I’ve been working on a project that involved Apps Script Execution API, it was running perfect in the developer account but as soon as the code was migrated to the client’s Google account, it failed.

{
  "error": {
    "status": "PERMISSION_DENIED",
    "message": "The caller does not have permission",
    "code": 403
  }
}

The Google APIs were enabled in the Google Developers Console, the scopes were correct, the Apps Script Execution API was published with “Anyone” account but the script would fail each time the user tried authentication.

  var op = gapi.client.request({
    'root': 'https://script.googleapis.com',
    'path': 'v1/scripts/' + SCRIPT_ID + ':run',
    'method': 'POST',
    'body': request
  });

Turned out the problem was somewhere else. The Request Body that is sent with the HTTP POST request has a parameter called devMode. The default is false but is generally set to true in the development mode to save the developer from having to publish a new version every time a change is made to the code.

  var request = {
    'function': 'ctrlq',
    'parameters': [],
    'devMode': true // Should be set to FALSE
  };

Remember to set devMode to false during deployment and the Permission Denied error would be fixed.