The Merchant API strictly requires authentication. You can authenticate using
[OAuth 2.0](https://developers.google.com/identity/protocols/oauth2)
credentials, a Service Account, or
[Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials)
(commonly used for testing and local development).

You can use a
[service account](https://cloud.google.com/iam/docs/service-account-overview) to
authorize Merchant API access to your own Merchant Center account. See
[authorize third-party app access to Merchant Center accounts](https://developers.google.com/merchant/api/guides/authorization/access-client-accounts)
if your app needs to access your clients' Merchant Center accounts.

A service account is a special kind of account, typically used by an
application rather than a person. A service account is identified by its email
address, which is unique to the account.

You must have a
[Merchant Center account](https://support.google.com/merchants/answer/188924) before
you can complete these steps.

> [!CAUTION]
> **Caution:** **API keys are not supported** by the Merchant API. Attempting to use an API key to authorize requests will result in a `401 UNAUTHENTICATED` error `CREDENTIALS_MISSING`.

## Create a service account

Generate service account credentials, or access the public credentials you've
already generated, then create an OAuth 2.0 Client ID:

1. Go to the [Google API Console](https://console.cloud.google.com/apis/library).
2. Select a project in the drop-down menu at the top of the page, or click **NEW PROJECT** to create one.
3. Search for Merchant API in the list of Google APIs, and make sure it's enabled for this project.
4. Click **Manage**.
5. In the sidebar on the left, select **Credentials** . You might need to click the left-pointing arrow at the top left of the page to see **Credentials**.
6. Select **CREATE CREDENTIALS** , then **Service account**.
7. Name the service account. This is the default username for the service account ID. Save the service account ID, including the part after the '@' character, for later use.
8. Click **CREATE** , go through the optional steps to grant access to the
   project and users, then click **DONE**.

   > [!NOTE]
   > **Note:** The role you choose the service account doesn't affect Merchant API access. Access to Merchant API methods is determined by the role associated with the service account ID in Merchant Center. If you don't know what to pick, choose **Project \> Viewer**.

## Get a JSON private key

Generate a JSON private key for your service account in the in the
[Google API Console](https://console.cloud.google.com/apis/library):

1. Click the service account, then select the **KEYS** tab.
2. Click **ADD KEY \> Create new key**.
3. Select **JSON** as the key type.
4. Click **CREATE** to download the private key. Note: You can only download the private key when it's created. You can't come back to this step later.

## Give the service account access to your Merchant Center account

Add the new service account as a user to your Merchant Center account:

1. Sign in to [Merchant Center](https://merchants.google.com).
2. Click **Settings** settings.
3. In the drop-down, click **Access and services**.
4. Under "People and access" tab, click **Add person**.
5. Enter your service account ID as the email address for the new person.

   If you didn't save your service account ID, go to the
   [Service Accounts](https://console.developers.google.com/iam-admin/serviceaccounts/)
   administration page, and select your project.
6. Specify the [**User access**](https://support.google.com/merchants/answer/1637190)
   and **Email notifications** preferences for the service account.

   > [!NOTE]
   > **Note:** Services accounts need **Admin** access to manage Merchant Center account information and settings.

7. Click **Add user** to save and return to the list of users.
   The service account ID should now be listed with the chosen user role.

You can repeat these steps for all service accounts that need to access your
Merchant Center account data.

> [!NOTE]
> **Note:** If you're a third-party provider and don't have direct access to the Merchant Center account, ask your client to add the service account as a user in Merchant Center and tell them the service account ID. We recommend [oAuth](https://developers.google.com/merchant/api/guides/authorization/access-client-accounts) instead of service accounts for third-party access.

## Frequently asked questions

Can I sign in to the Merchant Center UI with my service account?
:   No, service accounts aren't regular Google Accounts and can't access the
    Merchant Center UI.

How often do I need to refresh service account access tokens?
:   Access tokens expire one hour after they're issued by the Google OAuth 2.0
    Authorization Server. When an access token expires, the application should
    use the client library to fetch another access token. To manually refresh
    your token, delete the `stored-token.json` file and re-authenticate.