Configuring service account authentication for Google Cloud Platform (GCP)

Prerequisites

To provide the service account file, you must create a Google Cloud Platform (GCP) project first. Refer to the GCP documentation to learn how to create a GCP project.

Creating a service account key

The following procedure describes how to create a service account:

  1. To open the service account creator, select APIs & Services » Credentials in your GCP project.

  2. Select Create credentials » service account.

  3. In the Service account details form type in a service account name of your choice.

  4. Click Done to create the service account.

  5. After creating a service account find it on the list in the Credentials section and press on its name in order to manage the service account.

  6. Select Keys » Add key » Create a new key.

  7. In the key type selection view choose the recommended JSON type and press Create in order to save the service account key file, which will be needed during the connector configuration.

Formatting the service account key

The service account key downloaded in the previous step can be used to automatically fill in the form when configuring the connector, using the drag-and-drop functionality in the configuration wizard.

In case the private key is entered manually, it must be properly formatted first.

Example service account key, in JSON format:

{
  "type": "service_account",
  "project_id": "your-project-id0809",
  "private_key_id": "7a7df777f88...f7f7s8d7f7s",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADC9ON1OA4JjRidj\n/7O5Ioq+L2112946/CsXsfiHFwIQQedWt\nQ75sl7M5lHTsVQtIdtBcGJXvk5/7CHOmtkn6w\n2dRoyCWv2bknmogZIy3fssMolwVaZ15cmsuB0\nwTI81dojSVwrzPshiYY9lfugdVZ2uiFcw4haWo8o\nUhg2tHOWyveoFN2RF03kUfdnEfhAAmXKZai\nWkd49r+jAgMBAAECggEAIP/5TIE9LJ4QAZcXG2sEQl7GldrQho0nuAOVkEtzQsuP\ndmgbFYU39qinuLc83GF/Ghr3PdswzQTKeKCvZZXhQ4FpYk9VhyQr6iTKv6bBD8du\nMrF2LKknax1eCFG81o0A+zOvo\npMrJl/9EOOVJKnifhH7kdS/JRqHXEzQUGkpOWSs6ep7MGN4+vLv+GlZqIIgEGwmW\nJN/72+5bLiaL9T7If1+/T/sa\n-----END PRIVATE KEY-----\n",
  "client_email": "testclientemail.gserviceaccount.com",
  "client_id": "2345345634546456",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/you-project.....",
  "universe_domain": "googleapis.com"
}
Copy

For the private key, only the text between —–BEGIN PRIVATE KEY—–, —–END PRIVATE KEY—– is relevant.

To transform a private key to the format acceptable by the connector, do the following:

  1. Open the key downloaded in the prior step in a text editor.

  2. Copy the content of the private_key field.

  3. Delete both —–BEGIN PRIVATE KEY—– and —–END PRIVATE KEY—– markers.

  4. Delete all \n (newline) characters from the file. Usually there are more than 10 occurences in a given key.

  5. Save the file for later use.

After edits your key should resemble:

MIIEvgIBADC9ON1OA4JjRidj/7O5Ioq+L2112946/CsXsfiHFwIQQedWtQ75sl7M5lHTsVQtIdtBcGJXvk5/7CHOmtkn6w2dRoyCWv2bknmogZIy3fssMolwVaZ15cmsuB0wTI81dojSVwrzPshiYY9lfugdVZ2uiFcw4haWo8oUhg2tHOWyveoFN2RF03kUfdnEfhAAmXKZaiWkd49r+jAgMBAAECggEAIP/5TIE9LJ4QAZcXG2sEQl7GldrQho0nuAOVkEtzQsuPdmgbFYU39qinuLc83GF/Ghr3PdswzQTKeKCvZZXhQ4FpYk9VhyQr6iTKv6bBD8duMrF2LKknax1eCFG81o0A+zOvopMrJl/9EOOVJKnifhH7kdS/JRqHXEzQUGkpOWSs6ep7MGN4+vLv+GlZqIIgEGwmWJN/72+5bLiaL9T7If1+/T/sa
Copy

Granting the service account access to Google Analytics

The Service Account needs access to all Google Analytics properties that the connector will use. The following procedure describes how to grant access:

  1. Open the Google Analytics console and choose a property that will be used by the connector.

  2. Select the Property access management tab.

  3. Add the Service Account email as a Viewer.

  4. Repeat this process for all properties that will be used in the connector.