# Google service accounts (/integrations/google-service-account)
Google service accounts can access shared resources directly or impersonate a Google Workspace user through domain-wide delegation. This guide covers the JSON key, required APIs, delegation scopes, and credential setup in Sim.
For example, you could build a workflow that iterates through a list of employees, impersonates each one to read their Google Docs, and uploads the contents to a shared knowledge base — all without requiring any of those users to sign in.
## Prerequisites \[#prerequisites]
Create the service account and enable its APIs in Google Cloud. Configure the Google Workspace Admin Console only when using domain-wide delegation.
### 1. Create a service account in Google Cloud \[#1-create-a-service-account-in-google-cloud]
Go to the [Google Cloud Console](https://console.cloud.google.com/) and select your project (or create one)
Navigate to **IAM & Admin** → **Service Accounts**
Click **Create Service Account**, give it a name and description, then click **Create and Continue**
Skip the optional role and user access steps and click **Done**
Click on the newly created service account, go to the **Keys** tab, and click **Add Key** → **Create new key**
Select **JSON** as the key type and click **Create**. A JSON key file will download — keep this safe
Warning:
The JSON key file contains your service account's private key. Treat it like a password — do not commit it to source control or share it publicly.
### 2. Enable the required APIs \[#2-enable-the-required-apis]
In the Google Cloud Console, go to **APIs & Services** → **Library** and enable the APIs for the services your workflows will use. See the [scopes reference](#scopes-reference) below for the full list of APIs by service.
### 3. Set up domain-wide delegation \[#3-set-up-domain-wide-delegation]
In the Google Cloud Console, go to **IAM & Admin** → **Service Accounts**, click on your service account, and copy the **Client ID** (the numeric ID, not the email)
Open the [Google Workspace Admin Console](https://admin.google.com/) and navigate to **Security** → **Access and data control** → **API controls**
Click **Manage Domain Wide Delegation**, then click **Add new**
Paste the **Client ID** from your service account, then add the OAuth scopes for the services your workflows need. Copy the full scope URLs from the [scopes reference](#scopes-reference) below — only authorize scopes for services you plan to use.
Click **Authorize**
Domain-wide delegation requires a Google Workspace **super administrator**. Send that administrator the Client ID and required scopes. Changes can take up to 24 hours to propagate.
### Scopes reference \[#scopes-reference]
The table below lists the Google Workspace and BigQuery services covered by this guide, the API to enable in Google Cloud Console, and the delegation scopes to authorize. Copy the scope string for each service you need and paste it into the Google Workspace Admin Console.
| Service | API to Enable | Delegation Scopes |
| - | - | - |
| Gmail | Gmail API | `https://www.googleapis.com/auth/gmail.send`
`https://www.googleapis.com/auth/gmail.modify`
`https://www.googleapis.com/auth/gmail.labels` |
| Google Sheets | Google Sheets API, Google Drive API | `https://www.googleapis.com/auth/drive`
`https://www.googleapis.com/auth/drive.file` |
| Google Drive | Google Drive API | `https://www.googleapis.com/auth/drive`
`https://www.googleapis.com/auth/drive.file` |
| Google Docs | Google Docs API, Google Drive API | `https://www.googleapis.com/auth/drive`
`https://www.googleapis.com/auth/drive.file` |
| Google Slides | Google Slides API, Google Drive API | `https://www.googleapis.com/auth/drive`
`https://www.googleapis.com/auth/drive.file` |
| Google Forms | Google Forms API, Google Drive API | `https://www.googleapis.com/auth/drive`
`https://www.googleapis.com/auth/forms.body`
`https://www.googleapis.com/auth/forms.responses.readonly` |
| Google Calendar | Google Calendar API | `https://www.googleapis.com/auth/calendar` |
| Google Contacts | People API | `https://www.googleapis.com/auth/contacts` |
| BigQuery | BigQuery API | `https://www.googleapis.com/auth/bigquery` |
| Google Tasks | Tasks API | `https://www.googleapis.com/auth/tasks` |
| Google Vault | Vault API, Cloud Storage API | `https://www.googleapis.com/auth/ediscovery`
`https://www.googleapis.com/auth/devstorage.read_only` |
| Google Groups | Admin SDK API | `https://www.googleapis.com/auth/admin.directory.group`
`https://www.googleapis.com/auth/admin.directory.group.member` |
| Google Meet | Google Meet API | `https://www.googleapis.com/auth/meetings.space.created`
`https://www.googleapis.com/auth/meetings.space.readonly` |
The Google Groups entry covers Directory API actions. **Get Settings** and **Update Settings** require the Groups Settings API and its `https://www.googleapis.com/auth/apps.groups.settings` scope, which Sim's current Google Groups scope list does not request. See the [Google Groups reference](/integrations/google_groups) for this compatibility limit.
You only need to enable APIs and authorize scopes for the services you plan to use. When authorizing multiple services, combine their scope strings with commas into a single entry in the Admin Console.
## Add the service account to Sim \[#adding-the-service-account-to-sim]
Once Google Cloud and Workspace are configured, add the service account as a credential in Sim.
Open **Integrations** from your workspace sidebar
Search for "Google Drive" and open it, or use another Google integration that supports service-account credentials. Click **Add to Sim** and choose **Add service account**
Paste the full contents into **JSON key**, or use **Or upload a file** to select the JSON key file.
Give the credential a display name (the service account email is used by default)
Click **Add service account**
The JSON key file is validated for the required fields (`type`, `client_email`, `private_key`, `project_id`) and encrypted before being stored.
## Use delegated access in workflows \[#using-delegated-access-in-workflows]
When you use a Google block (Gmail, Sheets, Drive, etc.) in a workflow and select a service account credential, an **Impersonated Account** field appears below the credential selector.
Enter the email address of the Google Workspace user you want the service account to act as. For example, if you enter `alice@yourcompany.com`, the workflow will send emails from Alice's account, read her spreadsheets, or access her calendar — depending on the scopes you authorized.
Warning:
The impersonated email must belong to a user in the Google Workspace domain where you configured domain-wide delegation. Impersonating external email addresses will fail.
## Shared access and key rotation \[#shared-access-and-key-rotation]
Leave **Impersonated Account** blank to authenticate as the service account itself. Share supported resources, such as a Sheet, with its service-account email. This does not grant access to a user’s Gmail. A Google Cloud IAM role alone does not grant access to Google Workspace files or mailbox data.
Domain-wide delegation requires a Google Workspace super administrator. It authorizes impersonation within that Workspace domain, subject to the authorized scopes and the impersonated user’s access. Consumer Gmail accounts and users outside that domain cannot be impersonated. Access also depends on the license required by the target service. See [Google’s service-account authorization guide](https://developers.google.com/identity/protocols/oauth2/service-account).
A credential can serve multiple supported Google services when their APIs and scopes are configured. To rotate its key, create a replacement JSON key, update the credential in Sim, verify access, then delete the old key in Google Cloud.