Troubleshooting gsc-indexer: 403, 401, and other errors
Posted on July 19, 2026 by Abhay khant
Key Takeaways
Fix every gsc-indexer error: 403, 401, 429/5xx, sitemap fetch failures, 'no URLs given', and the 'unexpected argument' flag-order trap.
A lookup table of every error you can actually hit, and the fix for each.
403. "You do not own this site, or the inspected URL is not part of this property"
The most common error. Three causes, in order of likelihood:
- The service account isn't added to the property. Go to GSC → Settings →
Users and permissions, and add the SA's
client_emailas a Full user. See service-account setup. - Added as Restricted, not Full. Restricted users can't inspect URLs. Remove and re-add as Full.
- URL host doesn't match the property.
https://toolsura.com/andhttps://www.toolsura.com/are different properties. Inspect the URL exactly as it appears in the property prefix.
401. when using -apikey
The GSC URL Inspection API requires OAuth, not an API key. API keys return
401. Use -creds with your sa.json instead. (An API key is accepted by
the flag parser but will always 401 at the API.)
HTTP 429 / 5xx. throttling
Google is rate-limiting you. The tool already retries with backoff, but if it
persists, raise -delay (e.g. -delay 10s). See
throttling guide.
Sitemap fetch fails (404 / timeout)
- 404. the sitemap URL is wrong; open it in a browser to confirm.
- timeout. the host is slow or down; the fetch has a 30s limit.
"no URLs given"
You started the tool without any URL, batch file, or piped input. Provide one:
./gsc-indexer -creds sa.json "https://www.toolsura.com/"
Empty / zero results
- Piping but forgot the pipe?
cat urls.txt | ./gsc-indexer …. without the pipe, stdin is your keyboard and the run finds nothing. - Batch file path wrong or empty.
Unexpected argument "-something"
A flag placed after a URL gets treated as a URL (Go stops parsing flags at the first non-flag). Put all flags before URLs:
## wrong: ./gsc-indexer -creds sa.json "url" -color always
## right: ./gsc-indexer -creds sa.json -color always "url"
Permissions / scope
The tool requests the webmasters.readonly OAuth scope. Even so, the service
account still needs Full property access in GSC. scope alone isn't enough
to inspect.
5-point diagnostic checklist
- Cloud project exists and Search Console API is enabled
-
sa.jsonpresent and readable - SA email added to the property as Full
- Property prefix exactly matches the inspected URL (
www,https) - Using
-creds, not-apikey
If all five check out and it still fails, re-run with -dry-run to isolate
whether the problem is URL expansion or the API call.
Sources
- Google Search Console
- URL Inspection API documentation
- Google Search APIs overview
- Service account OAuth (Google Identity)
- About service accounts (Google Cloud IAM)
- Verify site ownership
- Property types: URL-prefix vs Domain
- URL Inspection tool help
- Indexing API (JobPosting/BroadcastEvent only)
- Request indexing / inspect a URL
Frequently Asked Questions
My 403 says 'you do not own this site'. What now?
Check the three causes in order: the service account is not added to the property, it was added as Restricted instead of Full, or the URL host does not match the property prefix. https and www are separate properties, so inspect the URL exactly as registered.
Why do I get 401 when I use -apikey?
The URL Inspection API requires OAuth, not an API key, so a key always returns 401. Use -creds with your sa.json instead. The flag parser accepts an API key without complaint, but the API rejects it at call time, which is why the error appears mid-run.
I see HTTP 429 or 5xx. Am I blocked?
You are being rate-limited. The tool retries with backoff, but if it persists, raise -delay (try 10s) and use -q for a clean progress line. For sitemap runs, preview with -dry-run first so you are not mid-run when throttling starts.
It says 'no URLs given'. What did I do?
You started the tool with no URL, batch file, or piped input. Provide at least one source, such as a positional URL, -batch file, or a stdin pipe. A bare './gsc-indexer -creds sa.json' with nothing to inspect exits immediately with that message.
Why did a flag like -color get treated as a URL?
Go stops parsing flags at the first non-flag argument, so a flag placed after a URL becomes a positional URL and triggers a 403. Always put every flag before the URLs. gsc-indexer also rejects a leading dash in a URL with a clear 'flags must come before URLs' error.