Use the following steps to set up a Google Workspace (formerly GSuite) Service account.
Log on to https://console.cloud.google.com with a Super User account.
You will need a project. If you have not created one, refer to this page for instructions: https://support.google.com/googleapi/answer/6251787?hl=en.
The image below is what you should see. In this example, “TATest” is the project (1). If your project is not listed, select it from the list at the top of the screen (2).
Open the menu (1), navigate to IAM & admin (2), and select Service accounts (3).
Select the + CREATE SERVICE ACCOUNT link at the top of the page.
Enter the Service account name (1) and Service account description (2) and then select the CREATE AND CONTINUE button (3).
Do not select a role on the next page; just click CONTINUE.
You will now be on the “Grant users access to this service account” step of the process. Click DONE.
You will now be on the service account page. Find and click on your account.
Select the KEYS (1) tab. Then, from the ADD KEY menu (2), select Create new key (3).
Select JSON (1) and click Create (2).
Select the Details tab (1) and open the SHOW DOMAN-WIDE DELEGATION menu (2).
Select Enable G Suite Domain-wide Delegation (1) and click SAVE (2).
Note: If you want the Service Account to have read-only access, you will leave this box blank.
You will see a “Unique ID” and “Client ID” fields on your service account with a value. Take note of this number as you will need to use it later.
Now go to https://console.developers.google.com/apis/library and log in with a Super Admin account.
Select your project from the project list (1). (“TATest” is our sample project.)
Search for “Google Drive API.”
Select the “Google Drive API” tile.
Select the ENABLE button.
If you did it correctly, you can search for “Google Drive API” and select it again. It should look like this.
Search for “Admin SDK API.”
Select the “Admin SDK API” tile.
Select the ENABLE button.
If done correctly, you can search again and verify it looks like this.
You only need these two APIs to be enabled. Other default APIs are selected when you create the project but they aren’t needed.
Now go to https://admin.google.com and log in with a Super Admin account.
Scroll down and select the Security icon.
Under Security, select the API Controls.
This will open the following screen. Select Manage Domain Wide Delegation.
Get the “Client ID” from downloaded JSON.
Paste the “Client ID” value in the “Client ID” field
Paste this string of scopes in the “One or More API Scopes” box (you will need to copy the scopes to Notepad first then remove the line break):
https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/drive
Client IDhttps://www.googleapis.com/auth/admin.directory.grouphttps://www.googleapis.com/auth/admin.directory.userhttps://www.googleapis.com/auth/driveSelect the Authorize button.
If done correctly, it should look like this.
If not yours does not look like the example, select the Remove link at the end of the row and try again.