Google API credentials

Fields

Field	Type	Required	Notes
Service Account Email email	string	Yes	The service account email address (e.g. my-bot@my-project.iam.gserviceaccount.com)
Private Key privateKey	password	Yes	The RSA private key from the service account JSON key file. Include the full PEM text.
Delegated Email (optional) delegatedEmail	string	No	If domain-wide delegation is configured, specify the user email to impersonate.

Getting your credentials

1. In the Google Cloud Console, select or create the project the automation should belong to.
2. Enable the specific Google APIs the nodes you plan to use require. A service account with no enabled API returns permission errors even when the key is valid.
3. Create a service account under IAM & Admin, giving it a descriptive name.
4. Create a JSON key for that service account and download it. This is the only time the private key is available.
5. From the downloaded JSON, copy client_email into the credential’s Email field and private_key into the Private Key field, including the BEGIN and END lines exactly as they appear.

Permissions and scopes

A service account is its own identity — it does not automatically see your files or data. Grant it access explicitly:

• For Google Cloud resources, assign IAM roles to the service account.
• For a specific Drive file or folder, share that item with the service account’s email address exactly as you would with a colleague.
• For Workspace-wide access, configure domain-wide delegation in the Google Workspace admin console, authorising the service account’s client ID for the scopes required. Then set Delegated Email to the user to impersonate.

Troubleshooting

• 403 with an API disabled message — the relevant API is not enabled on the project. Enable it and retry.
• 404 or empty results on Drive — the file or folder has not been shared with the service account’s email address.
• Invalid key or JWT signature errors — the private key was reformatted on paste. It must include the header and footer lines and the newlines within it.
• Delegated email rejected — domain-wide delegation is not configured, or the required scopes were not authorised for the service account’s client ID in the Workspace admin console.