Google - How to Setup Google API Service Account with Google G-Suite

Last updated About 2 months ago

Google - How to Setup Google API Service Account with Google G-Suite

There are 2 steps for setting up a Google API Service account with your Google G-Suite system.

Security Information:    Setting up a service account is Google's preferred method for allowing 3rd party applications to have access to your systems data.   The security of this setup can be broken down into 2 main points:

1.  User Account Created in Google G-Suite System - You will be creating a user account in your Google G-Suite system that we can impersonate with API calls.  You should not share the password with us.   We do not need to login to the Google G-Suite system.  We are only using the API  to access information, and should never need to login.  

2.  API Scopes -  In later steps in the instructions you will be adding API scopes to the system.  These scopes tell the Google G-Suite system we can only read basic user information and read your list of org units.  The scopes are read only.  They do not give us access to creating, updating, or deleting any information in your system.

The combination of these 2 items means we can only access your system through API, and our API access is limited to read only.  

Please let the Pathful representative know if you have any questions regarding the security of the setup.

Step 1:  Create a user in Google G-Suite with the User Management Admin role level.

  • We recommend creating a user vjs-admin@yourdomain.com

  • Let the VirtualJobShadow.com/VjsJunior.com developer know what username you have chosen.

Step 2:  Add Service Account client ID to the your Google G-Suite system.

  • In your Google G-Suite Admin Console go to Security section.

  • While in Security section, scroll down to the bottom of the page and click API Controls.

  • In API Controls section, click Manage Domain Wide Delegation at the bottom of the page.

  • Click Add New in the API Clients section.

  • Add the Client ID, check Overwrite existing Client ID, and add both of the Oauth Scopes and click Authorize.

    • Client ID : 117372373967232733069

    • Oauth Scope 1:  https://www.googleapis.com/auth/admin.directory.user.readonly

    • Oauth Scope 2:  https://www.googleapis.com/auth/admin.directory.orgunit.readonly

  • You are all done!