# Authorization

API calls to the zero-touch enrollment customer API need authorization.
Requiring authorization protects your organization's data. To authorize calls to
the zero-touch enrollment API, you need to complete the following tasks:

1. [Create a service account](https://developers.google.com/zero-touch/guides/customer/service-accounts#create-service) to call the APIs.
2. [Store the JSON key file](https://developers.google.com/zero-touch/guides/customer/service-accounts#store-key) to authorize the API calls.
3. [Enable the API](https://developers.google.com/zero-touch/guides/customer/service-accounts#enable-api) to make it available to the service account.
4. [Link the service account](https://developers.google.com/zero-touch/guides/customer/service-accounts#link-account) to make API calls on behalf of your organization.

Use the instructions below to help you complete the tasks.

## Step 1: create a service account

A service account, sometimes called a robot account, is a Google Account
representing applications instead of users. Your app calls APIs on behalf of the
service account, so users aren't directly involved. Because your app is using
Google APIs, use the Google API Console to set up access.

### Create an API Console project

It's good practice to create a new API Console project and service
account for your app. This makes managing access, managing resources, and fixing
lost keys easier in the future. Start by following the steps below to create a
new project in Google API Console:

1. Go to the [API Console](https://console.cloud.google.com/).
2. From the projects list, select **[Create a project](https://console.cloud.google.com/projectcreate)**.
3. Enter a name that describes your app and zero-touch enrollment.
4. Specify a project ID or accept the default.
5. Click **Create**.

To find out more, read the Google Cloud Platform document [Manage projects in
the console](https://support.google.com/cloud/answer/6158853).

### Add new service credentials

To add new credentials and a service account to your project, follow the steps
below in your API Console.

1. Open the [**Service accounts** page](https://console.cloud.google.com/iam-admin/serviceaccounts). If prompted, select a project.
2. Click **Create Service Account** , enter a name and description for the service account. You can use the default service account ID, or choose a different, unique one. When done click **Create**.
3. The **Service account permissions (optional)** section that follows is not required. Click **Continue**.
4. On the **Grant users access to this service account** screen, scroll down to the **Create key** section. Click **Create key**.
5. In the side panel that appears, select the format for your key: **JSON** is recommended.
6. Click **Create** . Your new public/private key pair is generated and downloaded to your machine; it serves as the only copy of this key. For information on how to store it securely, see [Managing service account keys](https://cloud.google.com/iam/docs/understanding-service-accounts#managing_service_account_keys).
7. Click **Close** on the **Private key saved to your computer** dialog, then click **Done** to return to the table of your service accounts.

Copy the email address of the service account and keep it handy. You need it
later when you link the service account to your organization.

## Step 2: store the JSON key file

API Console generates a new private key pair used to authenticate
API calls made using your service account. The private key is in the JSON key
file you download.

You should keep the key private, so don't include it in your app's source code.
If you lose the key file, you need to generate a new pair of keys.

> [!WARNING]
> **Warning:** Service account keys can become a security risk if not managed carefully. For advice see [best practices for managing API keys](https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys).

## Step 3: enable the API

Before your app can use the API, you need to enable it. Enabling an API
associates it with the current API Console project and adds
monitoring pages in your console.

To enable the API, follow the steps below in your API Console:

1. Click **APIs \& Services \>
   [Library](https://console.cloud.google.com/apis/library)**.
2. Use the search field to find the [*Android Device Provisioning Partner
   API*](https://console.cloud.google.com/apis/library?q=Android+Device+Provisioning+Partner+API).
3. Click *Android Device Provisioning Partner API*.
4. Click **Enable**.

After a short delay, the API status changes to enabled. If you don't see
*Android Device Provisioning Partner API*, check your organization is onboarded
into zero-touch enrollment. Make sure you're using the same Google Account for
zero-touch enrollment and Google API Console.

## Step 4: link the service account

Linking the service account with your organization's zero-touch enrollment
account authorizes the service account to make API calls on behalf of your
organization. Fill out the link [request form](https://docs.google.com/forms/d/e/1FAIpQLSePl6v3uL4eylDvf7j8FG4IdYPYn_Qqgmv_HiDMwkwVX-47rw/viewform?usp=sf_link) to link your
service account.

If you can't find the email address of the service account you created, copy it
from one of the following places:

- The **Service account email** from [**Service accounts** page](https://console.cloud.google.com/iam-admin/serviceaccounts) in the Google API Console.
- The `client_email` property field in the JSON key file.

Once you receive email confirmation that your account is linked, your service
account can then make calls to the customer API on behalf of your organization.

## Try out the API

Test that your API access is working by following the steps in one of the
quickstart guides for
[Java](https://developers.google.com/zero-touch/guides/customer/quickstart/java-service-account),
[.NET](https://developers.google.com/zero-touch/guides/customer/quickstart/dotnet-service-account), and
[Python](https://developers.google.com/zero-touch/guides/customer/quickstart/python-service-account).

## Authorization scopes

Use the API authorization scope
`https://www.googleapis.com/auth/androidworkzerotouchemm` in your app to request
an OAuth 2.0 access token.

A scope parameter controls the set of resources and operations that an access
token permits calls to. Access tokens are valid only for the set of operations
and resources described in the scope of the token request. The API covers all
the methods and resources with the single zero-touch enrollment scope shown
above.

To learn more about using Google API scopes, read
[Using OAuth 2.0 to Access Google APIs](https://developers.google.com/identity/protocols/OAuth2).