Create access credentials

  • Google Workspace APIs require credentials, which can be API keys, OAuth client IDs, or service accounts, depending on the type of access needed.

  • API keys provide anonymous access to public data and are created in the Google Cloud console.

  • OAuth client IDs are used for accessing user data with consent and require separate IDs for different platforms.

  • Service accounts enable applications to access data or act on behalf of users and require role assignment and secure key management.

  • Creating a service account involves assigning roles, generating keys, and optionally configuring domain-wide delegation for accessing user data on behalf of the application.

Credentials are used to obtain an access token from Google's authorization servers so your app can call Google Workspace APIs. This document describes how to choose and set up the credentials your app needs.

Choose the access credential that's right for you

The required credentials depend on the type of data, platform, and access methodology of your app. There are three types of credentials available:

Use case Authentication method About this authentication method
Access publicly available data anonymously in your app. API keys Check that the API you want to use supports API keys before using this authentication method.
Access user data such as their email address or age. OAuth client ID Requires your app to request and receive consent from the user.
Access data owned by your app, specific shared documents (such as Google Sheets), or access Google Workspace resources on behalf of users through domain-wide delegation. Service account When an app authenticates as a service account, it has access to all resources that the service account has permission to access.

For definitions of terms found on this page, see the Authentication and authorization overview.

API key credentials

An API key is a long string containing upper and lower case letters, numbers, underscores, and hyphens, such as AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe. This authentication method is used to anonymously access publicly available data, such as Google Workspace files shared using the "Anyone on the Internet with this link" sharing setting. For more details, see Manage API keys.

To create an API key:

  1. In the Google Cloud console, go to Menu > APIs & Services > Credentials.

    Go to Credentials

  2. Click Create credentials > API key.
  3. Your new API key is displayed.
    • Click Copy to copy your API key for use in your app's code. The API key can also be found in the "API Keys" section of your project's credentials.
    • To prevent unauthorized use, we recommend restricting where and for which APIs the API key can be used. For more details, see Add API restrictions.

OAuth client ID credentials

To authenticate end users and access user data in your app, you need to create one or more OAuth 2.0 Client IDs. A client ID is used to identify a single app to Google's OAuth servers. If your app runs on multiple platforms, you must create a separate client ID for each platform.

Choose your application type for specific instructions about how to create an OAuth client ID:

Web application

  1. In the Google Cloud Console, go to Menu > Google Auth platform > Clients.

    Go to Clients

  2. Click Create Client.
  3. Click Application type > Web application.
  4. In the Name field, type a name for the credential. This name is only shown in the Google Cloud Console.
  5. Add authorized URIs related to your app:
    • Client-side apps (JavaScript)–Under Authorized JavaScript origins, click Add URI. Then, enter a URI to use for browser requests. This identifies the domains from which your application can send API requests to the OAuth 2.0 server.
    • Server-side apps (Java, Python, and more)–Under Authorized redirect URIs, click Add URI. Then, enter an endpoint URI to which the OAuth 2.0 server can send responses.
  6. Click Create.

    The newly created credential appears under OAuth 2.0 Client IDs.

    Note that client secrets aren't used for Web applications.

Android

  1. In the Google Cloud Console, go to Menu > Google Auth platform > Clients.

    Go to Clients

  2. Click Create Client.
  3. Click Application type > Android.
  4. In the Name field, type a name for the credential. This name is only shown in the Google Cloud Console.
  5. In the Package name field, enter the package name from your AndroidManifest.xml file.
  6. In the SHA-1 certificate fingerprint field, enter your generated SHA-1 certificate fingerprint.
  7. Click Create.

    The newly created credential appears under "OAuth 2.0 Client IDs."

iOS

  1. In the Google Cloud Console, go to Menu > Google Auth platform > Clients.

    Go to Clients

  2. Click Create Client.
  3. Click Application type > iOS.
  4. In the Name field, type a name for the credential. This name is only shown in the Google Cloud Console.
  5. In the Bundle ID field, enter the bundle identifier as listed in the app's Info.plist file.
  6. Optional: If your app appears in the Apple App Store, enter the App Store ID.
  7. Optional: In the Team ID field, enter the unique 10-character string that's generated by Apple and assigned to your team.
  8. Click Create.

    The newly created credential appears under "OAuth 2.0 Client IDs."

Chrome Extension

  1. In the Google Cloud Console, go to Menu > Google Auth platform > Clients.

    Go to Clients

  2. Click Create Client.
  3. Click Application type > Chrome Extension.
  4. In the Name field, type a name for the credential. This name is only shown in the Google Cloud Console.
  5. In the Item ID field, enter your app's unique 32-character ID string. You can find this ID value in your app's Chrome Web Store URL and in the Chrome Web Store Developer Dashboard.
  6. Click Create.

    The newly created credential appears under "OAuth 2.0 Client IDs."

Desktop app

  1. In the Google Cloud Console, go to Menu > Google Auth platform > Clients.

    Go to Clients

  2. Click Create Client.
  3. Click Application type > Desktop app.
  4. In the Name field, type a name for the credential. This name is only shown in the Google Cloud Console.
  5. Click Create.

    The newly created credential appears under "OAuth 2.0 Client IDs."

TVs and Limited Input devices

  1. In the Google Cloud Console, go to Menu > Google Auth platform > Clients.

    Go to Clients

  2. Click Create Client.
  3. Click Application type > TVs and Limited Input devices.
  4. In the Name field, type a name for the credential. This name is only shown in the Google Cloud Console.
  5. Click Create.

    The newly created credential appears under "OAuth 2.0 Client IDs."

Service account credentials

A service account is a special kind of account used by an application, rather than a person. You can use a service account to access data or perform actions by the robot account, or to access data on behalf of Google Workspace or Cloud Identity users. For more information, see Service accounts overview.