Skip to content

Service Account Authentication

What is a Service Account?

A service account is a special type of Google account that belongs to your application rather than to a person. Think of it as a "robot email address" that Usuro uses to access your Google Ads and Google Search Console data on your behalf.

When should I use a Service Account instead of OAuth?

Usuro supports two ways to connect your Google accounts:

  • OAuth (Sign in with Google): You sign in with your personal Google account. Simple and quick, but the connection is tied to your individual account.
  • Service Account: A shared, application-level credential that is not tied to any single person. This is the better choice when:
    • Multiple team members need access through Usuro without depending on one person's login.
    • You want the connection to keep working even if a team member leaves the organization.
    • Your company requires credentials that are managed centrally rather than individually.

Prerequisites

Before you begin, make sure you have:

  • A Google account with access to Google Cloud Console
  • Admin or Manager access to your Google Ads account (if connecting Google Ads)
  • Owner access to your Google Search Console property (if connecting Search Console)

Step 1: Create a Google Cloud Project

If you already have a Google Cloud project you want to use, skip to Step 2.

  1. Go to Google Cloud Console.
  2. Click the project dropdown at the top of the page (it may say "Select a project" or show an existing project name).
  3. In the popup window, click New Project in the top-right corner.
  4. Enter a Project name (for example, "Usuro Integration").
  5. Click Create.
  6. Wait a moment for the project to be created, then select it from the project dropdown.

Step 2: Create a Service Account

  1. In the Google Cloud Console, open the navigation menu (the three horizontal lines icon, known as the "hamburger menu," in the top-left corner).
  2. Go to IAM & Admin > Service Accounts.
  3. Click + Create Service Account at the top of the page.
  4. Fill in the details:
    • Service account name: Choose a descriptive name (for example, "usuro-marketing").
    • Service account ID: This fills in automatically based on the name. You can leave it as-is.
    • Description (optional): Something like "Service account for Usuro marketing platform."
  5. Click Create and Continue.
  6. On the next screen ("Grant this service account access to project"), you can skip this step — the permissions Usuro needs will come from Google Ads and Search Console directly, not from the Cloud project. Click Continue.
  7. On the final screen ("Grant users access to this service account"), click Done.

You will now see your new service account listed on the Service Accounts page. Take note of the email address — it will look something like usuro-marketing@your-project.iam.gserviceaccount.com. You will need this email later.

Step 3: Download the JSON Key

  1. On the Service Accounts page, click the service account you just created.
  2. Go to the Keys tab.
  3. Click Add Key > Create new key.
  4. Select JSON as the key type.
  5. Click Create.

The JSON key file will download automatically to your computer.

Keep this file safe

This JSON file is your credential — treat it like a password. Store it in a secure location and do not share it with anyone outside your team. You cannot download this file again. If you lose it, you will need to create a new key and re-upload it in Usuro.

Getting an error when creating the key?

Some organizations have a security policy that blocks the creation of service account keys. If you see an error message like "Key creation is not allowed on this service account" or a reference to the policy iam.disableServiceAccountKeyCreation, it means your company's IT team has restricted this action.

How to resolve this:

  1. Contact your IT or Cloud Infrastructure team — they manage the Google Cloud organization policies.

  2. Ask them to allow service account key creation for your specific project. You can share this message with them:

    "The organization policy constraints/iam.disableServiceAccountKeyCreation is currently enforced on project [your project name]. We need to create a service account key to connect our Google Ads / Search Console accounts to Usuro. Could you grant a per-project exception for this project?"

  3. Your IT team can create an exception for your project only, without changing the policy for the rest of the organization. They will need the Organization Policy Administrator role to do this.

Once the exception is in place, come back to this step and try creating the key again.

Step 4: Enable the Required APIs

You need to enable the Google APIs that Usuro will use to connect to your accounts.

If you are connecting Google Ads:

  1. In the Google Cloud Console, go to APIs & Services > Library (from the navigation menu).
  2. Search for "Google Ads API".
  3. Click on Google Ads API in the results.
  4. Click Enable.

If you are connecting Google Search Console:

  1. In the Google Cloud Console, go to APIs & Services > Library.
  2. Search for "Google Search Console API".
  3. Click on Google Search Console API in the results.
  4. Click Enable.

Tip

If you plan to use both Google Ads and Google Search Console with Usuro, enable both APIs now to save time.

Step 5: Grant Access in Google Ads

Now you need to give your service account permission to access your Google Ads data.

  1. Sign in to Google Ads with an account that has Admin access.
  2. In the left sidebar, click the Admin icon.
  3. Click Access and security.
  4. Click the + (plus) button to invite a new user.
  5. In the email field, paste the service account email address from Step 2 (the one that looks like usuro-marketing@your-project.iam.gserviceaccount.com).

  6. Select an access level. We recommend Standard access, which allows Usuro to manage and optimize your campaigns. Here are the available options:

    Access Level What it allows
    Admin Full control, including managing other users' access
    Standard (recommended) Manage campaigns, view reports, make optimizations
    Read only View campaigns and reports only, no changes allowed

  7. Click Send invitation.

The invitation is automatically accepted for service accounts — no further action is needed.

Step 6: Grant Access in Google Search Console

Now give your service account permission to access your Search Console data.

  1. Go to Google Search Console.
  2. Select the property (website) you want to connect.
  3. In the left sidebar, click Settings (near the bottom).
  4. Click Users and permissions.
  5. Click Add user.
  6. In the email field, paste the service account email address from Step 2.

  7. Select a permission level. We recommend Full permission, which allows Usuro to read all your search performance data. Here are the available options:

    Permission Level What it allows
    Owner Full control, including adding and removing other users
    Full (recommended) View all data, submit sitemaps, request indexing
    Restricted View most data, but cannot take actions

  8. Click Add.

Step 7: Upload Credentials in Usuro

Now that your service account is set up and has the right permissions, you can connect it to Usuro.

  1. Go to Usuro and sign in to your account.
  2. Click Integrations in the header at the top of the page.
  3. A menu will open showing each available tool. Click the tool you want to connect (for example, Google Ads or Google Search Console).
  4. Click Upload credentials and select the JSON file you downloaded in Step 3.

Note

If the tool is already connected via OAuth or a previous service account, you will need to click Disconnect first, and then click Upload credentials to upload the new JSON file.

Repeat this process for each Google tool you want to connect with the same service account.

Troubleshooting

"API has not been enabled" error Go back to Step 4 and make sure you enabled the correct API (Google Ads API or Google Search Console API) in the same Google Cloud project where you created the service account.

"Permission denied" or "Access denied" error This usually means the service account email was not granted access in Google Ads or Google Search Console. Go back to Step 5 or Step 6 and verify the service account email address was added correctly.

"Invalid credentials" error Make sure you are uploading the correct JSON file — it should be from the same service account that you granted access to in Google Ads or Search Console. If you downloaded multiple key files, double-check you are using the right one.

Lost your JSON key file? You cannot re-download a JSON key. Go back to Step 3 and create a new key for the same service account, then upload the new file in Usuro.