Set Up Google Cloud Service Account and Domain-Wide Delegation

Mohammad Kanny
44 steps
4 minutes

Google Admin

Google Cloud

Bassemlabs

Google Account

STEP 1 — Create a Google Cloud Project

Visit [**https://console.cloud.google.com**](https://console.cloud.google.com/) **and sign in**

Click "Select a project"

Click "New project"

Type "BassemLabs Integration"

Click "Create"

STEP 2 — Create a Service Account

Click "IAM & Admin"

Click "Service Accounts"

Click "Create service account"

Click the "Service account name" field.

Click "Create and continue"

Lets add a role for this service account

Click "Owner"

Click "Continue"

Click "Done"

STEP 3 — Generate the Service Account Key (JSON)

Lets open this new service account

Click "Keys"

Click "Create new key"

Click "Create"

Keep in mind that we will use this JSON file later in BassemLabs.

STEP 4 — Enable Required Google APIs

Your system needs the following APIs: - **Admin SDK API** - **Classroom API** - **Google Calendar API** Let's enable them one by one!

Click "Library"

Search for "admin sdk api"

Click "Admin SDK API"

Click "Enable"

Now we will do the same for Classroom API and Google Calendar API

Click "Library"

Click "Google Enterprise API"

Click "Enable"

Click this icon.

Click "Library"

Click "Google Calendar API"

Click "Enable"

STEP 5 — Enable Domain-Wide Delegation

Let's go to "Service Accounts"

Click on our service account

Copy account's "Unique ID"

We will use this ID in the next step.

Expand **"Advanced Settings"** and make sure that **"Domain-wide Delegation"** is active.

STEP 6 — Grant API Permissions in Google Admin Console

Security

Click "API controls"

Click "Manage domain wide delegation"

Click "Add new"

Paste the "Client ID" we've copied in the previous step

Now paste these scopes: `https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/classroom.courses, https://www.googleapis.com/auth/classroom.rosters,https://www.googleapis.com/auth/admin.directory.resource.calendar, https://www.googleapis.com/auth/calendar, ,https://www.googleapis.com/auth/classroom.coursework.me, https://www.googleapis.com/auth/classroom.coursework.me.readonly, https://www.googleapis.com/auth/classroom.courses.readonly, https://www.googleapis.com/auth/classroom.coursework.students, https://www.googleapis.com/auth/classroom.courseworkmaterials, https://www.googleapis.com/auth/classroom.student-submissions.students.readonly`

STEP 7 —Integrate with BassemLabs (add the keys)

Add Your "Google Admin Email" and Your "service account ID"

For "Google Admin Service Account Key" field, lets paste the JSON file we've downloaded earlier.

Set Up Google Cloud Service Account and Domain-Wide Delegation

Mohammad Kanny
44 steps
4 minutes

Google Admin

Google Cloud

Bassemlabs

Google Account

STEP 1 — Create a Google Cloud Project

Visit [**https://console.cloud.google.com**](https://console.cloud.google.com/) **and sign in**

Click "Select a project"

Click "New project"

Type "BassemLabs Integration"

Click "Create"

STEP 2 — Create a Service Account

Click "IAM & Admin"

Click "Service Accounts"

Click "Create service account"

Click the "Service account name" field.

Click "Create and continue"

Lets add a role for this service account

Click "Owner"

Click "Continue"

Click "Done"

STEP 3 — Generate the Service Account Key (JSON)

Lets open this new service account

Click "Keys"

Click "Create new key"

Click "Create"

Keep in mind that we will use this JSON file later in BassemLabs.

STEP 4 — Enable Required Google APIs

Your system needs the following APIs: - **Admin SDK API** - **Classroom API** - **Google Calendar API** Let's enable them one by one!

Click "Library"

Search for "admin sdk api"

Click "Admin SDK API"

Click "Enable"

Now we will do the same for Classroom API and Google Calendar API

Click "Library"

Click "Google Enterprise API"

Click "Enable"

Click this icon.

Click "Library"

Click "Google Calendar API"

Click "Enable"

STEP 5 — Enable Domain-Wide Delegation

Let's go to "Service Accounts"

Click on our service account

Copy account's "Unique ID"

We will use this ID in the next step.

Expand **"Advanced Settings"** and make sure that **"Domain-wide Delegation"** is active.

STEP 6 — Grant API Permissions in Google Admin Console

Security

Click "API controls"

Click "Manage domain wide delegation"

Click "Add new"

Paste the "Client ID" we've copied in the previous step

STEP 7 —Integrate with BassemLabs (add the keys)

Add Your "Google Admin Email" and Your "service account ID"

For "Google Admin Service Account Key" field, lets paste the JSON file we've downloaded earlier.