Authorize your client ID

Next, authorize your service account’s client ID.

  1. Sign in to your Google Admin console.

    Sign in using an account with super administrator privileges (does not end in @gmail.com).

  2. From the Admin console Home page, go to "" and then Security and then API controls.
  3. Under Domain wide delegation, click Manage Domain Wide Delegation.
  4. On the Manage domain wide delegation page, click Add new.
  5. Under Client ID, enter your service account's client ID.

    You can find the service account client ID in the JSON file you downloaded when you created the service account. Alternatively, you can find the client ID in the Google Cloud Platform Console. Click IAM & Adminand thenService accounts, then select your service account.

    Note: Make sure you use the service account client ID, not the OAuth Web client ID.

  6. In the OAuth scopes field, copy and paste the following comma-delimited list of scopes:

    https://www.googleapis.com/auth/admin.directory.user,
    https://www.googleapis.com/auth/admin.directory.customer.readonly,
    https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,
    https://www.googleapis.com/auth/userinfo.email,
    https://www.googleapis.com/auth/migrate.deployment.interop

  7. Click Authorize.
  8. To make sure every scope appears, select the new client ID and click View details.

    If they don't, click Edit, enter the missing scopes, and click Authorize. Note that you can't edit the client ID.

If you get an error, the client ID might not be registered with Google or there might be duplicate or unsupported scopes. The app should be available for use within an hour, but might take up to 24 hours.

Next step

Download the installers