Google Workspace

Subscribe
Download 212
Last updated Oct 15, 2026

3-1. Service Account

Follow these steps only if you use the service account method.

Step 1: Service Account and Key

  1. Enter 'IAM' in the Google Cloud console search bar and click IAM & Admin.

    IAM & Admin

  2. Click Service Accounts > Create service account.

  3. Enter a name (e.g., logpresso) and click Create and close.

    Create service account

  4. Click the email of the new service account to open its details page.

    Open service account details

  5. Click Keys > Add key > Create new key.

    Create new key

  6. Select JSON as the key type and click Create. The key file is downloaded automatically. Store it in a safe place.

    Create JSON key

    Key file saved

Step 2: Domain-wide Delegation

  1. On the service account details page, copy the Client ID under Details > Advanced settings, and click VIEW GOOGLE WORKSPACE ADMIN CONSOLE.

    Copy client ID

  2. In the Admin console, go to Security > Access and data control > API controls and click Manage Domain Wide Delegation.

    Manage domain-wide delegation

  3. Click Add new, enter the client ID and OAuth scopes, and click Authorize. Enter only the scopes for the features you will use from 1. Required Permissions, separated by commas.

    Add a new client ID

    To use all features, paste the following string as-is.

    https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/drive.apps.readonly,https://www.googleapis.com/auth/apps.alerts,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/spreadsheets.readonly,https://www.googleapis.com/auth/spreadsheets
App versionScopes to register
1.9.2610.0 or laterOnly the scopes for the features you use (the string above is the 8 scopes for all features)
Earlier than 1.9.2610.0The app requests all scopes at once, so register all 9 below. If any one is missing, no feature works: admin.reports.audit.readonly, drive.apps.readonly, apps.alerts, admin.directory.domain.readonly, admin.directory.user.readonly, admin.directory.group.readonly, spreadsheets, drive.activity.readonly, contacts.readonly
Caution
  • Scope names in domain-wide delegation must match exactly. For example, registering spreadsheets does not count as registering spreadsheets.readonly.
  • To reduce previously registered scopes, upgrade the app to 1.9.2610.0 or later first. Reducing them before upgrading stops all collectors and query commands.
  • Domain-wide delegation lets the service account access the registered scopes on behalf of every user in the organization. Do not register scopes for features you do not use, and keep the key file secure.