3. Choosing an Authentication Method
The Google Workspace app supports two authentication methods.
| Item | Service account | User account OAuth |
|---|---|---|
| Credentials | Service account key (JSON) + domain-wide delegation | Refresh token issued with the consent of the dedicated integration account |
| Available features | All features | All features except Alert Center |
| Where OAuth scopes are set | Domain-wide delegation in the Admin console | OAuth consent screen |
| If credentials leak | Access to all users in the organization within the registered scopes | Limited to the privileges of the one consenting account |
| Credential lifetime | Valid until the key is deleted | Expires on password change, access revocation, or 6 months of inactivity |
- If you do not collect Alert Center, the user account OAuth method is recommended because the impact of a leak is smaller.
- To collect Alert Center as well, use the service account method.
- You can also create connect profiles for both methods and assign only the Alert Center collector to the service account profile.
Once you have chosen a method, follow the steps on its page.