OAuth Service Account Flow

AI-generated Key Takeaways

• This guide explains how to set up OAuth2 for API access using service accounts, requiring a Google Workspace domain and domain-wide delegation access.

• You need to generate a service account ID and JSON file before configuring the client library for service account authentication.

• The client library setup involves providing the private key JSON file path and delegate account ID in your configuration file or environment variables.

• Ensure no OAuth2 desktop or web app flow credentials are present in your configuration to prioritize Service Account authentication.

This guide will walk you through how to setup OAuth2 for API access using your own credentials using service accounts. These steps only need to be done once, unless you revoke or delete your OAuth2 credentials.

Create OAuth2 credentials

Note: This flow requires a Google Workspace domain and the service account that you created needs to be granted domain wide delegation access by a super administrator for the domain.

Generate a service (delegate) account ID and a *.JSON file by following the linked instructions, then come back to this page.

Set up client library

Set the private key JSON file path and delegate account ID in your configuration. If you're using a googleads.properties file, add the following:

jsonKeyFilePath=PRIVATE_KEY_FILE_PATH
impersonatedEmail=DELEGATE_ACCOUNT

If you're using environment variables, add the following to your Bash configuration or environment:

export GOOGLE_ADS_JSON_KEY_FILE_PATH=PRIVATE_KEY_FILE_PATH
export GOOGLE_ADS_IMPERSONATED_EMAIL=DELEGATE_ACCOUNT_ID

Key Point: When loading configurations, the library first looks for credentials from the OAuth2 desktop or web app flows, and then uses them if found. So if you want to use a Service Account authentication, make sure credentials for the other flows are not present in your configuration.