> For the complete documentation index, see [llms.txt](https://docs.aurinko.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aurinko.io/authentication/service-accounts/setting-up-g-suite-service-account.md).

# Setting up G Suite service account

To generate service-account credentials, or to view the public credentials that you've already generated, do the following in your Google API Console:

1. Open the [Service accounts page](/authentication/service-accounts.md).
2. If prompted, select a project, or create a new one. Refer to [this article](/authentication/google-oauth-setup.md) if creating a new project, the following API's need to be enabled: Gmail API, Google Calendar API, Contacts API, Google People API, and Tasks API.
3. Click **Create service account**.

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5f062d6904286306f80662ee/file-dbDE54UOkR.jpg" alt=""><figcaption></figcaption></figure></div>

4. Under **Service account details**, type a name, ID, and description for the service account, then click **Create**.

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5f06307f2c7d3a10cbaa3bce/file-TVd6h5i5Tp.jpg" alt=""><figcaption></figcaption></figure></div>

5. Optional: Under **Service account permissions**, select the IAM roles to grant to the service account, then click **Continue**.
6. Optional: Under **Grant users access to this service account**, add the users or groups that are allowed to use and manage the service account.
7. From the main "Service accounts" screen select the newly created account

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5f06332404286306f8066384/file-Xql5fiM9SF.jpg" alt=""><figcaption></figcaption></figure></div>

8. Use "EDIT" mode to activate "G Suite Domain-wide Delegation" and also copy the **Unique ID** (you will need it later). Click ADD KEY to create a new JSON key if there is no key yet (you will need to upload this key to Aurinko).  Then save the form.

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5f06347404286306f80663a5/file-7uzn6eyQ00.jpg" alt=""><figcaption></figcaption></figure></div>

Now an administrator of the G Suite domain needs to delegate authority to the service account, using the Unique ID value you copied.

1. From your G Suite domain’s [Admin console](https://admin.google.com/), go to **Main menu menu > Security > Advanced settings \[API Controls].**
2. In the **Domain wide delegation** pane, select **Manage Domain Wide Delegation**.
3. Click **Add new**.

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5f0638252c7d3a10cbaa3c8a/file-K1rKt1BSne.jpg" alt=""><figcaption></figcaption></figure></div>

4. In the **Client ID** field, enter the service account's **Unique ID** that you have copied.
5. In the **OAuth scopes (comma-delimited)** field, enter the list of scopes that your application should be granted access to. Aurinko API will need these scopes <https://www.googleapis.com/auth/gmai.modify>, \
   <https://www.googleapis.com/auth/gmail.send>, \
   <https://www.googleapis.com/auth/calendar>, \
   <https://www.googleapis.com/auth/contacts>, \
   <https://www.googleapis.com/auth/tasks>
6. Click **Authorize**.