Go to main content Go to main menu
Proxima by Epinova Back to epinova.se

Creating a Google Service Account

Before AI Assistant can access Google APIs, you need to create a service account in Google Cloud Console. A service account represents your application (not a user) and is used for secure, programmatic access to services such as: Google Search Console, Google Analytics. All access is performed using a service account under your control, ensuring that your data remains secure and is never shared with or transferred to third parties.

Steps to Create a Service Account

1. Create a Google Cloud Project (Skip if already exists)

If you already have a project in Google Cloud Console, you can skip this step. Otherwise:

  1. Go to Google Cloud Console
  2. Click Select Project → New Project
  3. Provide: Project Name
  4. Click Create

2. Enable Required APIs

Navigate to APIs & Services → Library, then enable:

For Google Search Console: Search Console API

For Google Analytics (GA4): Google Analytics Data API, Google Analytics Admin API.

For Google Ads: Google Ads API.

Google Ads requires the API to be enabled in the project used for authentication. See Google's project setup guide.

3. Create a Service Account

  1. Go to IAM & Admin → Service Accounts
  2. Click Create Service Account
  3. Fill: Name, ID (auto-generated)
  4. Click Create and Continue
  5. Roles: You can skip assigning roles here
  6. Click Done

4. Generate Service Account Key

  1. Open the created service account
  2. Go to Keys → Add Key → Create new key
  3. Choose: JSON 
  4. Download the file

⚠️ This JSON file contains credentials - you should store it securely. 

5. Grant Access in Google Search Console

  1. Go to Google Search Console
  2. Select your property (domain or URL prefix)
  3. Go to Settings → Users and permissions
  4. Click Add User
  5. Add the service account email (e.g. your-account-name@project.iam.gserviceaccount.com)
  6. Assign role: Full

6. Grant Access in Google Analytics (GA4)

  1. Go to Google Analytics
  2. Navigate:
    • Admin → Property Access Management
  3. Click + → Add users
  4. Add the service account email
  5. Assign role: Analyst

7. Grant Access in Google Ads

The service account must be added as a user in the specific Google Ads customer account (the advertiser account whose campaigns and metrics AI Assistant will read)

  1. Sign in to Google Ads as an administrator of that customer account. If you normally work from an MCC, switch into the customer account before adding the user.
  2. Open Admin → Access and security → Users and click +.
  3. Enter the service account's email, such as ai-assistant@your-project.iam.gserviceaccount.com.
  4. Choose Read-only access level and click Add account.
  5. Verify that the service account appears in the users list. Service accounts receive access directly, without accepting an email invitation.

These steps follow Google's service account workflow.

Configure the Service Account in Your Application

Once the service account is created and permissions are granted, configure it in your application settings.

Example: Configure service account in appsettings.json

"Epinova": {
  "GoogleServices": {
     "Accounts": [
        {
          "ClientEmail": "epinova-ai-assistant@epinova-internal.iam.gserviceaccount.com",
          "PrivateKey": "-----BEGIN PRIVATE KEY----- xxxxxxx -----END PRIVATE KEY-----\n"
        }
      ]
    }
}

Notes

  • Ensure the private key preserves line breaks (\n)
  • Prefer storing secrets in:
    • Environment variables
    • Secret managers (e.g., Azure Key Vault)
  • Avoid hardcoding credentials in source code