Google Service Account: How to Quickly Create for AI Services

Google Service Account is used when AI services, n8n scenarios, or CRM integrations need to interact with Google APIs without requiring a user to log in. For example, an agent can read and write to Google Sheets, update data, or create files in Drive automatically on a schedule.

To do this, you need to create a service account in Google Cloud, obtain a JSON key, and provide it to the respective Google file in the settings.

How a Google Service Account Works

A Google Service Account acts as a virtual identity, allowing applications to perform actions without a user being logged in. This is essential for server-side scenarios, such as AI agents, background synchronizations, and no-code automations.

Typical use cases:

• AI agent reading from Google Sheets and transferring data to a CRM;
• n8n scenario updating a table;
• Telegram bot writing data to Google Sheets;
• Backend service creating files in Google Drive;
• Script periodically checking status and sending notifications.

You can find more about this in the automation of reports using Google Sheets + n8n article. Even if you are not a developer, you can set this up in a few simple steps.

Step-by-step setup instructions

Follow these steps to get started:

1. Create a project in the Google Cloud Console.
2. In Google Cloud, create a new service account.
3. Enable the required APIs: Sheets API, Drive API, Gmail API, Calendar API, etc.
4. Create a minimal key and download the JSON file.

Google provides a detailed guide on how to create service accounts in the Create Service Accounts documentation. To create the JSON key file, use the Service Account Key Admin role.

How to create a Google Service Account: step-by-step

Step 1. Open Google Cloud Console

Go to the Google Cloud Console and log in with your account. If you don’t have an account, create a new one. For AI integrations, it is recommended to create a separate project for each environment.

Do not forget to create a project before proceeding. A project is a container for all your APIs, quotas, billing, and keys.

Step 2. Enable the required APIs

Go to APIs & Services → Library and enable the APIs you need based on your services.

The most common for AI services are:

• Google Sheets API — for reading and writing tables;
• Google Drive API — for working with files, folders, and documents;
• Google Calendar API — for managing events and scheduling;
• Gmail API — for working with mail, if you need to send notifications without a personal account.

The API is not enabled by default, you must manually enable the required service for each project.

Step 3. Create a service account

In Google Cloud Console, go to IAM & Admin → Service Accounts and click Create service account.

Fill in the fields:

• Service account name — a descriptive name, e.g., ai-sheets-agent or n8n-google-sync;
• Service account ID — a unique ID, which usually takes the form of an email address;
• Description — a short description of the account’s purpose.

Google will generate an email for the account in the format name@project-id.iam.gserviceaccount.com. Use this address when granting access to tables or other resources.

Step 4. Assign IAM roles

This step is optional but important. To give the service account access to a specific Google Sheets table, you don’t necessarily need a role in the Google Cloud project. Just share the table with the service account’s email address. However, for some Drive operations, you might need to assign a role to the account.

This is a basic guide, your actual AI automation may require more advanced settings: an agent can read tables in real-time, and you can build an automation for the entire business. You can also use an agent to build a dashboard, which is a great way to track a project’s progress through a material interface.

Step 5. Create the JSON key

In the service account settings, go to the Keys tab, click Add key → Create new key, select JSON and click Create.

Google will download the JSON file. Warning: this file is a secret; do not upload it to public repositories. If you lose the file, you must generate a new key and update it in your settings.

The JSON should look like this:

{
  "type": "service_account",
  "project_id": "your-project-id",
  "private_key_id": "...",
  "private_key": "-----BEGIN PRIVATE KEY-----...",
  "client_email": "name@project-id.iam.gserviceaccount.com",
  "token_uri": "https://oauth2.googleapis.com/token"
}

Do not upload this file to GitHub, do not send it in chats, and do not publish it in open issues. The JSON key is the only thing the server needs to act as the service account.

Step 6. Grant access to Google Sheets and Drive

Since the AI service will interact with a concrete table, you must share that table in Google Sheets, click Share and add the service account email.

For simple reading, the Viewer role is enough. For updating cells, provide the Editor role. Similarly, if you need to work with Drive folders, share the folder with the service account email.

This is a basic guide: the key is enabled, the API is linked, and you have a table that doesn’t depend on a service account. In any case, the script can be updated to be more autonomous, but the key remains the same.

How to connect the JSON key to an AI service or n8n

The specific interface depends on the service, but the logic is almost the same everywhere:

1. Open the credentials or integrations settings.
2. Select Google Service Account.
3. Upload the JSON file or paste it into a secure field.
4. Specify the required scopes if the service asks for them separately.
5. Verify access using a test table or folder.

For n8n and similar platforms, service accounts are often used in scenarios where automation runs without human intervention: updating a CRM, collecting data in tables, creating tasks, or sending messages. If you are still choosing a platform, check out the comparison of n8n, Make, and Zapier for business.

Security: What Must Be Done

A Google Service Account with a JSON key should be treated as a technical user with real permissions. If the key falls into the wrong hands, they can do everything this account is allowed to do.

Google’s best practices for service accounts recommend creating separate accounts for separate applications, avoiding default service accounts, and not granting excessive permissions.

Practical minimum:

• Create a separate service account for each service or client;
• Grant access only to specific tables, folders, or APIs;
• Do not store the JSON key in a repository;
• Place the key in secrets: .env, vault, secret manager, or a secure field of the platform;
• Periodically check active keys and delete those that are no longer used;
• If a key might have been compromised, immediately create a new one and delete the old one.

The best practice is not to “give the key everything,” but first to describe the integration task, then grant minimal access and test only the required scenario.

Typical Mistakes

1. API is not enabled
   Service account is created, the key exists, but Google Sheets API or Drive API is not activated in the project. Solution: check APIs & Services → Enabled APIs & services.
2. Table is not shared with the service account
   A service account is a separate identity. If the table is in your personal Google Drive, you must explicitly share it with the service account email.
3. Too broad permissions
   An Owner or Editor role for the entire project is almost never needed for a simple table integration. Start with minimal access.
4. JSON key ended up on GitHub
   If a key was accidentally committed, simply deleting the file from the repository is not enough. You must delete the key itself in the Google Cloud Console and create a new one.
5. One service account for all tasks
   This is convenient at the start, but bad for auditing and security. When something breaks or a key needs to be revoked, it’s hard to understand which processes will be affected.

FAQ

Can I use one Google service account for several AI services?
Technically yes, but it’s better to create a separate service account for each service or scenario. This makes it easier to limit permissions, revoke access, and understand which integration performed an action.

How does a service account differ from OAuth?
OAuth is typically used when a service acts on behalf of a specific user after their consent. A service account is more suitable for server-side scenarios where the integration works as a technical account without manual login.

Do I need to add the service account to Google Workspace?
For basic work with a specific table, simply sharing the file with the service account email is usually enough. For more complex scenarios in Workspace, domain-wide delegation may be required, but this is a separate setting with higher security requirements.

Where to store the JSON key?
In a secure secrets store: server environment variables, Secret Manager, vault, or the credentials store of your automation platform. Do not store the key in open code, a Google Drive folder “for everyone,” or a public chat.

Key Takeaway

A Google Service Account with a JSON key is the basic tool for AI services that need to work stably with Google Sheets, Drive, Calendar, or other APIs. But its power lies in controlled access: a separate account for a separate task, minimal permissions, a protected JSON key, and regular checks of active access. If you plan to connect Google services to an AI agent, CRM, or n8n scenario, start not with the key, but with a process map: what data is needed, who reads it, who updates it, and what happens if access needs to be revoked quickly. This saves time and reduces risks even before launching automation.