Creating unique service account credentials

Creating a unique set of service account credentials provides more security. Unique service account credentials include the following:

• Client ID (a long number)
• Service account ID (email address)
• Service account certificate (a certificate in .pem format)

1. Go to Google API Console.
2. Log in with your Google Workspace account credentials.
3. Create a new project:
   1. Click the toolbar list. The browser displays the following dialog.

      

   2. Select your organization, if you see an organization dropdown list.
   3. Click the + button.
   4. In the Project name field, enter your project name, then click Create.
4. Enable the Admin SDK:
   1. Select your project from the toolbar list, then go to the Library tab.
   2. Under Google Workspace APIs, click Admin SDK.

      

   3. Click ENABLE.

      

5. Create a service account:
   1. Go to the Credentials tab and select Create Credentials > Service account key.
   2. From the Service account list, select New Service Account. Enter a service account name.
   3. From the Role list, select Project > Viewer.
   4. Select P12 as the Key type and click Create.

      

      After you create the service account, a private key with the P12 extension is saved on your computer.

      The private key with the P12 extension is the only copy you receive. Keep it in a safe place. You should also remember the password prompted on the screen. At this time, that password should be notasecret.

      

6. Go to the Credentials page > Manage service accounts.
7. Edit the service account you just created and select the Enable Google Apps Domain-Wide Delegation checkbox. Enter a Product name for the consent screen if this field appears.

   

8. Click Save.
9. Click View Client ID to see your service account information. Record the client ID, service account, and the associated private key (downloaded in step 5d).

   

To use the private key in EMS, it needs to be converted to .pem format. You can use the following openssl command to convert it. Remember to use the notasecret password. C:\OpenSSL-Win64\bin>openssl pkcs12 -in demo-976b9d6e9328.p12 -out serviceAccount-demo.pem -nodes -nocerts Enter Import Password: