gam upload sakey - falling at the last hurdle

[Temsnr]

Just trying to get a new GAM installation running and I'm dealing with the issue "Upload Failed: Constraint `constraints/iam.disableServiceAccountKeyUpload` violated for service account project..."

I don't understand the last part of the instructions, highlighted in yellow. I've tried various options but can't get it right.

None of the urls etc are the actual ones.

user@localhost:~> gam upload sakey administrator@....org
WARNING: Config File: /home/user/GAMConfig/gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: /home/temple/GAMConfig/oauth2.txt, Not Found

Go to the following link in a browser on this computer or on another computer:

    https://gam-shortn.appspot.com/abcde6

If you use a browser on another computer, you will get a browser error that the site can't be reached AFTER you
click the Allow button, paste "Unable to connect" URL from other computer (only URL data up to &scope required):

Enter verification code or paste "Unable to connect" URL from other computer (only URL data up to &scope required): 127.0.0.1 - - [31/Oct/2025 10:05:40] "GET /?state=zXGAF4o0gkjYCXzcu9FOawgLkL8RNo&code=4/0Ab32j90ZwQaDZZY0zpacSUrhOL7ACscz5pF7o7PQie53Lsd0LUhtSx_d4ULvLru4aBqoMg&scope=https://www.googleapis.com/auth/cloud-platform HTTP/1.1" 200 91

The authentication flow has completed.
Command: /home/user/bin/gam7/gam upload sakey >>>administrator@....org<<< 

[Ross Scroggs]

See: https://github.com/GAM-team/GAM/wiki/Authorization#authorize-service-account-key-uploads

Ross

----

Ross Scroggs

Ross.S...@gmail.com

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/902f1f99-ce26-4558-86ee-4a58bf6ead7en%40googlegroups.com.

[Temsnr]

hi Ross - yes, I followed it (I even put a spreadsheet column with checkboxes to make sure I had followed each step ...)  and it was the very last step where I got the error `gam upload sakey [admin <EmailAddress>]`

[Christopher Noon]

Maybe it's just the way you've anonymized the URL or something, but it doesn't look right.  You can just paste the entire URL into your terminal (ignoring the whole "only URL data up to &scope required" thing).  Is that what you're doing?

[Temsnr]

thank you for the feedback Christopher - I didn't make notes as I was in a bit of a rush and it wasn't straightforward (for me). 

In the call with Ross, we checked that I'd followed the process on the page mentioned earlier and then ran the following, and also went into IAM & Admin, Org policies etc... (you can see the history below)

`  gam info domain
  gam oauth create
  gam info domain
  gam config customer_id C02pt857l
  gam config customer_id C02pt857l domain russellcourtarchive.org timezone local save
  gam user administrator update serviceaccount
  gam user administrator check serviceaccount
  gam version`

apologies for the abysmal "notes". We had to repeat a few things, I don't know why, and we finished by upgrading to the latest version of GAM

Thank you very much Ross!