The documented route (Play Console > Setup > API access, grant the "Release manager" role) does not match the current console: that page is being retired, is account-level only so it is invisible while an app is open, and the named permission roles were replaced by individual checkboxes. The service account is actually created in Google Cloud Console; Play Console only invites it under Users and permissions. Also note the propagation delay, which presents as a first-run 401 and reads like a bad key. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>