# Using OAuth 2.0 service accounts with the Manufacturer Center API

Service accounts are special Google accounts that can be used by applications to
access Google APIs programmatically via OAuth 2.0. A service account uses an
OAuth 2.0 flow that does not require additional authorization. Instead, it uses
a key file that only your application can access. This guide discusses how to
access the Manufacturer Center API with service accounts.

> [!NOTE]
> **Note:** Applications using service accounts for authentication can only access your own Manufacturer Center account. If you are writing a third-party application that needs access to your clients' Manufacturer Center accounts, see the [Authorizing Requests](https://developers.google.com/manufacturers/how-tos/authorizing) guide instead.

## Prerequisites

- A [Manufacturer Center](https://manufacturers.google.com/) account.

## Steps to using a service account to access the Manufacturer Center API

1. Generate service-account credentials or access the public credentials you've
   already generated. You will need to create an OAuth 2.0 Client ID and obtain
   a \*.json private key file:

   1. Go to the [Google API Console](https://console.cloud.google.com/apis/library).

   2. Select a project in the drop-down menu at the top of the page. If you do
      not have one yet, create one by clicking **Create Project**.

   3. If you have not already enabled the Manufacturer Center API for this
      project, then search for it in the list of Google APIs and enable it.

   4. In the sidebar on the left, select **Credentials**.

   5. To set up a service account, select **Create credentials** , and then
      **Service account key**.

   ![Create service account credentials screenshot.](https://developers.google.com/manufacturers/images/create_service_account_credentials.png)
   1. On the next page, select **New service account** from the drop-down
      list.

   2. Name the new service account. This
      also serves as the default username for the service account ID. Remember
      the service account ID for use later.

   > [!NOTE]
   > **Note:** The choice of role for the service account will not have any effect on what calls can be made to the Manufacturer Center API, as access to Manufacturer Center API methods is determined instead by the role associated with the service account ID in Manufacturer Center. If you are unsure what to pick, just pick Project►Viewer.

   ![New service account name screenshot.](https://developers.google.com/manufacturers/images/new_service_account_name.png)
   1. Select **JSON** for the key type, then click **Create**.

   2. The **Create** button will change to **Creating...**, and once the key
      generation finishes, it will automatically download the private key as a
      \*.json file.

   > [!IMPORTANT]
   > **Important:** Protect the \*.json key file that allows a service account to access the Google services for which it has been authorized. It is good practice to allow service accounts to only access one Google API each. This is a preventative measure to mitigate the amount of data an attacker can access in the situation that the service account's \*.json key file is compromised.

   1. You will be returned to the Credentials page, and you should see the new service account in the list of service account keys for your account.
2. Add the new service account as a user to your Manufacturer Center account.
   If you are a third party developer, you will need to have your client do
   this step for you.

   1. Go to your [Manufacturer Center account](https://manufacturers.google.com/).

   2. Go to the 'Users' list in the settings of your Manufacturer Center
      account.

   3. Click the +User button, and use the service account ID as the email
      address for the new user.

      ![Add service account user button screenshot.](https://developers.google.com/manufacturers/images/add_service_account_network_settings.png)
   4. Fill in the form with the [service account ID](https://developers.google.com/manufacturers/how-tos/service-accounts#service-account-name),
      and select the desired user role(s). At least one must be chosen, and
      use of the `Accounts` service requires the Admin role.

   If you did not take note of the service account ID earlier, go to the
   [Service Accounts](https://console.developers.google.com/iam-admin/serviceaccounts/)
   administration page and select the project you created.

   ![Add service account user page screenshot.](https://developers.google.com/manufacturers/images/add_service_account_page.png)
   1. Click on the **Save** button. You will be returned to the list of users,
      and the service account ID should be listed with the chosen user role(s).

   2. Repeat the process for all other service accounts you want to add.

   3. View existing service account users by going to the Users tab. These
      will be users with an email address ending in 'gserviceaccount.com'.

3. Now you can access your Manufacturer Center account using the service
   account either by using the [Google Application Default
   Credentials](https://developers.google.com/identity/protocols/application-default-credentials) flow or by
   using the [service account flow](https://developers.google.com/identity/protocols/OAuth2ServiceAccount)
   directly. The Manufacturer Center API [Samples](https://developers.google.com/manufacturers/libraries)
   show how to use both flows for service account credentials in each supported
   programming language. See the code samples to try out your new service
   account and to learn what changes you will need to use service accounts in
   your own code.

## Frequently asked questions

#### Can I log into the Manufacturer Center web user interface with my service account?

No, service accounts are not regular Google accounts and cannot access the
Manufacturer Center web user interface.

#### How often do I need to refresh service account access tokens?

Access tokens expire one hour after they are issued by the Google OAuth 2.0
Authorization Server. When an access token expires, the application should use
the client library to fetch another access token.