Credentials are used to obtain an access token from Google's authorizationservers so your app can call Google Workspace APIs. This guide describes howto choose and set up the credentials your app needs.
For definitions of terms found on this page, seeAuthentication and authorization overview.
Choose the access credential that is right for you
The required credentials depends on the type of data, platform, and accessmethodology of your app. There are three types of credential types available:
| Use case | Authentication method | About this authentication method |
|---|---|---|
| Access publicly available data anonymously in your app. | API keys | Check that the API that you want to use supports API keys before using this authentication method. |
| Access user data such as their email address or age. | OAuth client ID | Requires your app to request and receive consent from the user. |
| Access data that belongs to your own application or access resources on behalf of Google Workspace or Cloud Identity users through domain-wide delegation. | Service account | When an app authenticates as a service account, it has access to all resources that the service account has permission to access. |
API key credentials
An API key is a long string containing upper and lower case letters, numbers,underscores, and hyphens, such as AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe.This authentication method is used to anonymously access publicly-availabledata, such as Google Workspace files shared using the "Anyone on the Internetwith this link" sharing setting. For more details, seeUsing API keys.
To create an API key:
- In the Google Cloud console, go to Menu menu > APIs & Services > Credentials.
Go to Credentials
- Click Create credentials > API key.
- Your new API key is displayed.
- Click Copy content_copy to copy your API key for use in your app's code. The API key can also be found in the "API keys" section of your project's credentials.
- Click Restrict key to update advanced settings and limit use of your API key. For more details, see Applying API key restrictions.
OAuth client ID credentials
To authenticate as an end user and access user data in your app, you need tocreate one or more OAuth 2.0 Client IDs. A client ID is used to identify asingle app to Google's OAuth servers. If your app runs on multiple platforms,you must create a separate client ID for each platform.
Choose your application type for specific instructions about how to create an OAuth client ID:
Web application
- In the Google Cloud console, go to Menu menu > APIs & Services > Credentials.
Go to Credentials
- Click Create Credentials > OAuth client ID.
- Click Application type > Web application.
- In the Name field, type a name for the credential. This name is only shown in the Google Cloud console.
- Add authorized URIs related to your app:
- Client-side apps (JavaScript)–Under Authorized JavaScript origins, click Add URI. Then, enter a URI to use for browser requests. This identifies the domains from which your application can send API requests to the OAuth 2.0 server.
- Server-side apps (Java, Python, and more)–Under Authorized redirect URIs, click Add URI. Then, enter an endpoint URI to which the OAuth 2.0 server can send responses.
- Click Create. The OAuth client created screen appears, showing your new Client ID and Client secret.
Note the Client ID. Client secrets aren't used for Web applications.
- Click OK. The newly created credential appears under OAuth 2.0 Client IDs.
Android
- In the Google Cloud console, go to Menu menu > APIs & Services > Credentials.
Go to Credentials
- Click Create Credentials > OAuth client ID.
- Click Application type > Android.
- In the "Name" field, type a name for the credential. This name is only shown in the Google Cloud console.
- In the "Package name" field, enter the package name from your
AndroidManifest.xmlfile. - In the "SHA-1 certificate fingerprint" field, enter your generated SHA-1 certificate fingerprint.
- Click Create. The OAuth client created screen appears, showing your new Client ID.
- Click OK. The newly created credential appears under "OAuth 2.0 Client IDs."
iOS
- In the Google Cloud console, go to Menu menu > APIs & Services > Credentials.
Go to Credentials
- Click Create Credentials > OAuth client ID.
- Click Application type > iOS.
- In the "Name" field, type a name for the credential. This name is only shown in the Google Cloud console.
- In the "Bundle ID" field, enter the bundle identifier as listed in the app's
Info.plistfile. - Optional: If your app appears in the Apple App Store, enter the App Store ID.
- Optional: In the "Team ID" field, enter the unique 10-character string, generated by Apple and assigned to your team.
- Click Create. The OAuth client created screen appears, showing your new Client ID and Client secret.
- Click OK. The newly created credential appears under "OAuth 2.0 Client IDs."
Chrome app
- In the Google Cloud console, go to Menu menu > APIs & Services > Credentials.
Go to Credentials
- Click Create Credentials > OAuth client ID.
- Click Application type > Chrome app.
- In the "Name" field, type a name for the credential. This name is only shown in the Google Cloud console.
- In the "Application ID" field, enter your app's unique 32-character ID string. You can find this ID value in your app's Chrome Web Store URL and in the Chrome Web Store Developer Dashboard.
- Click Create. The OAuth client created screen appears, showing your new Client ID and Client secret.
- Click OK. The newly created credential appears under "OAuth 2.0 Client IDs."
Desktop app
- In the Google Cloud console, go to Menu menu > APIs & Services > Credentials.
Go to Credentials
(Video) How to create Google Oauth2 installed application credentials.json. - Click Create Credentials > OAuth client ID.
- Click Application type > Desktop app.
- In the Name field, type a name for the credential. This name is only shown in the Google Cloud console.
- Click Create. The OAuth client created screen appears, showing your new Client ID and Client secret.
- Click OK. The newly created credential appears under OAuth 2.0 Client IDs.
TVs & Limited Input devices
- In the Google Cloud console, go to Menu menu > APIs & Services > Credentials.
Go to Credentials
- Click Create Credentials > OAuth client ID.
- Click Application type > TVs & Limited Input devices.
- In the "Name" field, type a name for the credential. This name is only shown in the Google Cloud console.
- Click Create. The OAuth client created screen appears, showing your new Client ID and Client secret.
- Click OK. The newly created credential appears under "OAuth 2.0 Client IDs."
Universal Windows Platform (UWP)
- In the Google Cloud console, go to Menu menu > APIs & Services > Credentials.
Go to Credentials
- Click Create Credentials > OAuth client ID.
- Click Application type > Universal Windows Platform (UWP).
- In the "Name" field, type a name for the credential. This name is only shown in the Google Cloud console.
- In the "Store ID" field, enter your app's unique, 12-character Microsoft Store ID value. You can find this ID in your app's Microsoft Store URL and in the Partner Center.
- Click Create. The OAuth client created screen appears, showing your new Client ID and Client secret.
- Click OK. The newly created credential appears under "OAuth 2.0 Client IDs."
Service account credentials
A service account is a special kind of account used by an application, ratherthan a person. You can use a service account to access data or perform actionsby the robot account, or to access data on behalf of Google Workspaceor Cloud Identity users. For more information, seeUnderstanding service accounts.
Create a service account
- In the Google Cloud console, go to Menu menu > IAM & Admin > Service Accounts.
Go to Service Accounts
- Click Create service account.
- Fill in the service account details, then click Create and continue.
- Optional: Assign roles to your service account to grant access to your Google Cloud project's resources. For more details, refer to Granting, changing, and revoking access to resources.
- Click Continue.
- Optional: Enter users or groups that can manage and perform actions with this service account. For more details, refer to Managing service account impersonation.
- Click Done. Make a note of the email address for the service account.
Assign a role to a service account
You must assign a prebuilt or custom role to a service account by a superadministrator account.
In the Google Admin console, go to Menumenu>Account > Admin roles.
Point to the role that you want to assign, and then click Assign admin.
(Video) #3. OAuth 2.0 | Generate Client ID & Client Secret For Google APIs |Click Assign service accounts.
Enter the email address of the service account.
Click Add > Assign role.
Create credentials for a service account
You need to obtain credentials in the form of a public/private key pair. Thesecredentials are used by your code to authorize service account actions withinyour app.
To obtain credentials for your service account:
- In the Google Cloud console, go to Menu menu > IAM & Admin > Service Accounts.
Go to Service Accounts
- Select your service account.
- Click Keys > Add key > Create new key.
- Select JSON, then click Create.
Your new public/private key pair is generated and downloaded to your machine as a new file. This file is the only copy of this key. For information about how to store your key securely, see Managing service account keys.
(Video) কিভাবে Google Ad Account Access অন্য কাউকে দেবেন? How to share Google Ad Account access? #googleads - Click Close.
Optional: Set up domain-wide delegation for a service account
To call APIs on behalf of users in a Google Workspace organization,your service account needs to be granted domain-wide delegation of authority inthe Google Workspace Admin console by a super administrator account. For moreinformation, seeDelegating domain-wide authority to a service account.
To set up domain-wide delegation of authority for a service account:
- In the Google Cloud console, go to Menu menu > IAM & Admin > Service Accounts.
Go to Service Accounts
- Select your service account.
- Click Show advanced settings.
- Under "Domain-wide delegation," find your service account's "Client ID." Click Copy content_copy to copy the client ID value to your clipboard.
If you have super administrator access to the relevant Google Workspace account, click View Google Workspace Admin Console, then sign in using a super administrator user account and continue following these steps.
If you don't have super administrator access to the relevant Google Workspace account, contact a super administrator for that account and send them your service account's Client ID and list of OAuth Scopes so they can complete the following steps in the Admin console.
- In the Google Admin console, go to Menu menu > Security > Access and data control > API controls.
Go to API controls
- Click Manage Domain Wide Delegation.
- Click Add new.
- In the "Client ID" field, paste the client ID that you previously copied.
- In the "OAuth Scopes" field, enter a comma-delimited list of the scopes required by your application. This is the same set of scopes you defined when configuring the OAuth consent screen.
- Click Authorize.
Next step
You're ready to develop on Google Workspace! Review the list ofGoogle Workspace developer products andhow to find help.
FAQs
Create access credentials | Google Workspace | Google for Developers? ›
In the Google Cloud console, go to Menu menu > More products > Google Workspace > Product Library. Click the API that you want to turn on. Click Enable.
How do I get API Credentials? ›- Access OneLogin as an account owner or administrator.
- Go to Developers > API Credentials.
- On the API Access page, click New Credential. Give your credential pair a meaningful name. ...
- Select a scope for the credentials. Authentication Only. ...
- Click Save. ...
- Click Done.
In the Google Cloud console, go to Menu menu > More products > Google Workspace > Product Library. Click the API that you want to turn on. Click Enable.
How do I create a client ID and client secret? ›- Go to the Google Developers Console.
- Click Select a project ➝ New Project ➝ the Create button.
- Enter your Project name ➝ click the Create button.
- Click OAuth consent screen in the left side menu ➝ choose User Type ➝ click the Create button.
- Log in to your GCP console and click on the hamburger icon at the top left corner.
- Hover on IAM & Admin > click on Service Accounts.
- Click on the : button beside the service account that needs to be monitored. ...
- Select the Key Type as JSON and click Create.
API credentials are unique identifiers that are required to access some API tools. Credentials are similar to API authentication, in that they provide a way for API owners to control who has access to their APIs, and they protect users from malicious usage.
Is an API key a credential? ›These credentials are in the form of an API key - a unique alphanumeric string that associates your Google billing account with your project, and with the specific API or SDK. This guide shows how to create, restrict, and use your API Key for Google Maps Platform.
How do I give access to Google developers? ›- Sign in to the Google Developers Console.
- Select a project.
- On the left menu, select Permissions.
- Near the top of your screen, select Add Member.
- Type the email address of the user you added to Play Console.
- Choose a permission level.
- Select Add.
You can sign in and access your Google Developer Profile by going to developers.google.com/profile/u/me.
Is Google Workspace for developers free? ›Get started with a free 14-day trial of Google Workspace or contact sales. After the trial ends, you can pay by credit card, or depending on the location of your business, you may also pay by direct debit or PayPal. You can also pre-pay by making a manual payment to your account.
What is the difference between client ID and client secret? ›
The Client ID is a public identifier of your application. The Client Secret is confidential and should only be used to authenticate your application and make requests to LinkedIn's APIs.
What is the difference between API Key and client ID? ›The API keys authenticate for APIs that do not access personal data. The client id authenticates with your Google Account. The service account authenticates your application when you do not want to use the login data of your own account (or any real persons account).
How to obtain OAuth 2.0 credentials from the Google API console? ›- Go to the Google API Console.
- Select a project, or create a new one. ...
- Click Continue to enable the Fitness API.
- Click Go to credentials.
- Click New credentials, then select OAuth Client ID.
- Under Application type select Android.
- In the Google Cloud console, go to the Service accounts page. Go to Service accounts. ...
- Select a project.
- Click the email address of the service account that you want to create a key for.
- Click the Keys tab.
- Click the Add key drop-down menu, then select Create new key.
- Select JSON as the Key type and click Create.
Create a secret
In the GCP console, search for “secret manager” and choose the one displayed below: Then click “CREATE SECRET” to create a new one: On the page opened, enter a name for the secret, which must be unique within a project.
Create credentials for a service account
In the Google Cloud console, go to Menu menu > IAM & Admin > Service Accounts. Select your service account. Click Keys > Add key > Create new key. Select JSON, then click Create.
While we often use the terms interchangeably, authorization and authentication are two separate functions. Authentication is the process of verifying who a user is, and authorization is the process of verifying what they have access to.
Do I need SSL certificate for API? ›Choosing the right SSL certificate for your API is crucial for ensuring its security, reliability, and trustworthiness. SSL certificates are digital documents that verify the identity and encryption of your API, and they are required for using HTTPS, the secure version of HTTP.
Does an API need a certificate? ›The server must provide a certificate that authenticates the server to the client.
What is the difference between API and API key? ›The main distinction between these two is: API keys identify the calling project — the application or site — making the call to an API. Authentication tokens identify a user — the person — that is using the app or site.
How do I generate an API key? ›
- Go to the API Console.
- From the projects list, select a project or create a new one.
- If the APIs & services page isn't already open, open the left side menu and select APIs & services.
- On the left, choose Credentials.
- Click Create credentials and then select API key.
So, access token is equivalent to API Key. Whoever gets it, should have it secure similar like API Keys. And OAuth calls should be made via HTTPS similar to API Key based calls. Another advantage over OAuth is Authorization.
How do I add a developer in access? ›The Developer tab isn't displayed by default, but you can add it to the ribbon. On the File tab, go to Options > Customize Ribbon. Under Customize the Ribbon and under Main Tabs, select the Developer check box.
How do I give a user access to developer console? ›Developer console is available only to users with "View All" and "Author Apex" permissions. To open the Developer Console, click Your Name | Developer Console, when in Classic UI. In LEX, Click on Setup and the Developer Console from the drop down menu.
How much does a Google developer account cost? ›Get your app on the Google Play store to let Android users download and use your app on their smartphones and tablets. In order to submit your app to Google Play, you must first create a Google Play developer account. Note: Google Play charges a $25 one-time developer fee.
How do I get a free Google developer account? ›- Go to the Google Play Developer Console <https://play.google.com/apps/publish/signup/> and sign up for an account.
- Read and agree to the Google Play Developer distribution agreement.
- Fill out your Google Play Developer Profile.
- 1 Go to "Settings"
- 2 Tap "About device" or "About phone"
- 3 Tap “Software information”
- 4 Tap “Build number” seven times. ...
- 5 Enter your pattern, PIN or password to enable the Developer options menu.
- 6 The "Developer options" menu will now appear in your Settings menu.
As we've evolved G Suite into a more integrated experience across our communication and collaboration tools, we've rebranded to Google Workspace to more accurately represent the product vision.
What is the difference between Google Workspace and free? ›The major difference between free Gmail and business Gmail (Google Workspace) is the design of the product. While free Gmail is designed for personal users, Google Workspace is specifically designed for business use, with business Gmail and team collaboration capabilities.
What is the difference between Google free and workspace? ›With a free Gmail account, you get access to basic apps and services, including Google Drive, Docs, Sheets and Slides. With Google Workspace, you get access to all of the same apps as Gmail, as well as Google Meet, Calendar, Chat, Keep Sites, Forms and Current.
How do I create a Google client ID? ›
- Open the Credentials page of the Google APIs console.
- Create or select a Google APIs project. ...
- Click Create credentials > OAuth client ID and for Application type select Web application to create a new client ID.
Amazon Web Services style API keys including a key ID and a secret key, which are used together to securely authenticate the client. The API key ID is included in all requests to identify the client. The secret key is known only to the client and the API Gateway.
Can Google client ID be public? ›Client ID : Is used to identify the application. Let's say you are building an App that would like to access google maps APIs, You need to register the app with google & google will give you client id which is an id to identify the client in our case it's your app. Client ID is publicly available.
What is the difference between OAuth and API keys? ›The difference is that API tokens incorporate the user account in the access token while OAuth apps perform authorization without a user account. When you make a choice of using an API token or an OAuth app to make an API call, you must consider the specific requirements of the API service involved in the interaction.
What should an API key look like? ›An API key is a token that a client provides when making API calls. The key can be sent in the query string: GET /something? api_key=abcdef12345.
What is the difference between authorization bearer and API key? ›Bearer Tokens are used for authentication purposes, while API Keys are used for authorization purposes. Bearer Tokens authenticate the client and provide access to the API resources, while API Keys grant access to specific endpoints or actions.
How do I authenticate an API without username and password? ›- Present a login page to the user that asks for PIN and password (or DOB, etc.) ...
- Use the access token to call the API and find the user based on the field you are using, that will give you the username for login (which is always an email address).
Username and password authentication. When you use the username and password method to authenticate, your script sends an HTTP header to the server during API function calls. This allows the script to effectively log in as the desired user before the function.
How do I create an OAuth 2.0 credential? ›- Go to the Google Cloud Platform Console.
- From the projects list, select a project or create a new one.
- If the APIs & services page isn't already open, open the console left side menu and select APIs & services.
- On the left, click Credentials.
- Click New Credentials, then select OAuth client ID.
Go to the Google Maps Platform > Credentials page. On the Credentials page, click Create credentials > API key. The API key created dialog displays your newly created API key.
Where is my API key? ›
Go to the Google Maps Platform > Credentials page. On the Credentials page, click Create credentials > API key. The API key created dialog displays your newly created API key.
How do I access my PayPal API credentials? ›Click the settings icon at the top of your PayPal account page and then click Account Settings. On the Account access page, click Update for the API access item. Click Manage API Credentials in the NVP/SOAP API Integration (Classic) section.
Can I get API key for free? ›API Keys is currently free of charge. If you are using Cloud Endpoints to manage your API, you might incur charges at high traffic volumes. See the Endpoints pricing and quotas page for more information.
Who provides the API key? ›API keys are available through platforms, such as a white-labeled internal marketplace. They also act as a unique identifier and provide a secret token for authentication purposes.
What is an API key example? ›An API key is a token that a client provides when making API calls. The key can be sent in the query string: GET /something? api_key=abcdef12345.
Do all websites have API keys? ›They help you out by providing developers with an API, or application programming interfaces. There are more than 16,000 APIs out there, and they can be helpful in gathering useful data from sites to use for your own applications. But not every site has them.
Does PayPal have an API key? ›At this time, our API isn't available for Personal accounts. To obtain API credentials to integrate PayPal's payment solution, you'll need to upgrade to a Business account. Here's how to upgrade to a Business account.
What is PayPal secret key? ›PayPal uses REST APIs, or application programming interfaces, to facilitate online payments. In order to make this process work, you may need to generate unique codes that allow the payment gateway to open—this is the Client ID and Secret Key.
How do I get a live credential for PayPal? ›- Log into the Developer Dashboard with your merchant account.
- On the My Apps & Credentials page, change to Live.
- Click Create App in the REST API apps section.
- Type a name for your app and click Create App.
- Make a note of your REST API client ID and secret.