Set up authentication for Merchant API

To ensure data security, enforce access control, and maintain system integrity, you must authenticate all Merchant API requests. The API uses the authenticated identity to determine the actions the caller has permission to perform. For example, some callers might have read-only access to product data, while others can modify account settings in the Merchant Center.

This document is part of a multi-part series about getting started with Merchant API. If you already have authentication set up with Merchant API, you can skip to the next section: Register as a developer

Authorize requests to Merchant API

Every request sent to the Merchant API must include an authorization token to identify your application to Google. To set up authentication and authorization, decide on the use case that best describes the way you plan to work with the Merchant API:

Are you building an application for other businesses to use?

If yes, you use OAuth 2.0 authorization. Choose OAuth 2.0 authorization if:

• You are a third-party provider or agency: You are building an application, such as a SaaS platform, that will be used by other businesses to manage their own Merchant Center data.
• You need to manage many external accounts: You want a single application to work across multiple, independent Merchant Center accounts owned by different clients. Your clients grant permissions by signing into their own Google Accounts and clicking "Allow" on a consent screen.

Are you building an app for your own business?

If yes, you use a service account authorization to get Merchant API access. Choose a service account authorization if:

• You are building your own in-house application: You are developing a tool specifically for your own business to manage your own Merchant Center data , or you want the credentials to belong to the application itself rather than a specific individual user.
• You need automation without human login: Your application runs background tasks such as automated inventory updates or "cron" jobs.

OAuth 2.0 authorization

If you're a third-party provider or agency managing multiple client accounts, your application must use OAuth 2.0 to authorize requests. Follow these steps to set up OAuth 2.0 for Merchant API:

1. Create OAuth 2.0 credentials in APIs and Services in your Google Cloud console
2. Download the OAuth2 client credentials to the file such as client-secrets.json
3. Add the email account as a user to Merchant Center: Make sure that the Google Account you use to authorize requests exists as a user in the Merchant Center. See How to add or remove a user from Merchant Center for more details
4. Assign it the Admin role to perform registration. For more information about roles, see Manage people and access levels in Merchant Center
5. Setup authentication with code samples: Follow the guidance from the official code samples Setting up Authentication and Sample Configuration documentation section

For more information about OAuth 2.0 authorization, see Authorize third-party app access to Merchant Center account and Using OAuth 2.0 to Access Google APIs.

Service account authorization

You use a service account to authorize Merchant API access to your own Merchant Center account. Follow these steps to set up service account authorization for Merchant API:

1. Create service account credentials in APIs and Services in your Google Cloud console
2. Download the private key: Create and download the private key in JSON format for the service account. Rename the file to service-account.json
3. Add the service account to Merchant Center: Copy the unique service account email address such as [e-mail] and add it as a new user in your Merchant Center. See How to add or remove a user from Merchant Center for more details
4. Assign it Admin access. For more information about access levels, see Manage people and access levels in Merchant Center
5. Setup authentication with code samples: Follow the guidance from the official code samples Setting up Authentication and Sample Configuration documentation section

For more information about service account authorization, see Authorize access to your Merchant Center account and Service accounts overview.