[Create connection] How to setup a Google service account and use it with ADvendio

What are service accounts?

A service account is a special kind of account used by an application or compute workload, such as a Compute Engine virtual machine (VM) instance, rather than a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself or as Google Workspace or Cloud Identity users through domain-wide delegation.

For example, a service account can be attached to a Compute Engine VM, so that applications running on that VM can authenticate as the service account. In addition, the service account can be granted IAM roles that let it access resources. The service account is used as the identity of the application, and the service account's roles control which resources the application can access.

A service account is identified by its email address, which is unique to the account.

Process Overview

This paragraph will show the necessary steps to create a Google Service Account and use it with ADvendio:

1. Create a Service Account in the Google Cloud Platform
2. Create a Service Account in the Google Ad Manager Platform by using the previously created account
3. Create a Google Type Connection in ADvendio by using the account as a username and create an OAuth token to enable the connection

1. Creating a service account in the Google Cloud Platform

When you create a service account, you must provide an alphanumeric ID (SA_NAME in the samples below), such as my-service-account. The ID must be between 6 and 30 characters and can contain lowercase alphanumeric characters and dashes. After you create a service account, you cannot change its name.

The service account's name appears in the email address that is provisioned during creation, in the format SA_NAME@PROJECT_ID.iam.gserviceaccount.com.

Each service account also has a permanent, unique numeric ID, which is generated automatically.

You also provide the following information when you create a service account:

• SA_DESCRIPTION is an optional description for the service account.

• SA_DISPLAY_NAME is a friendly name for the service account.

• PROJECT_ID is the ID of your Google Cloud project.

After you create a service account, you might need to wait for 60 seconds or more before you use the service account. This behavior occurs because read operations are eventually consistent; it can take time for the new service account to become visible. If you try to read or use a service account immediately after you create it, and you receive an error, you can retry the request with exponential backoff.

1.1 Steps:

1. In the Google Cloud console, go to the Create service account page.

   Go to Create service account

2. Select a Cloud project.

3. Enter a service account name to display in the Google Cloud console.

   The Google Cloud console generates a service account ID based on this name. Edit the ID if necessary. You cannot change the ID later.

4. Optional: Enter a description of the service account.

5. If you do not want to set access controls now, click Done to finish creating the service account.

   To set access controls now, click Create and continue and continue to the next step.

6. When you are done adding roles, click Continue.

7. Click Done to finish creating the service account.

After you create a service account, grant one or more roles to the service account so that it can act on your behalf.

Also, if the service account needs to access resources in other projects, you usually must enable the APIs for those resources in the project where you created the service account.

2. Create a Service Account in the Google Ad Manager Platform

After creating a Service Account in the Google Cloud console, access the Google Ad Manager Platform and go to Admin → Access & authorization.
Create a new user by pressing the button “New User“ and insert the info related to the previously created service account, as shown in the following image:

Open

Creating a New User in the Google Ad Manager Platform

3. Create a Google Type Connection in ADvendio

Use the App Launcher to navigate to the AdServer Login page or click on the “Overview” tab, where you will find the section "AdServer Interface", and within this section click on “Connections”

Click the “New”  button to create a new Google Ad Manager type connection and input the service account credentials as shown in the following example:

Open

The last step is to generate an OAuth Token to enable the connection: this can be done by pressing the button “Generate AdServer OAuth Token”.
Input the service account email as a username and press the “Submit” button

On the next page, click on the “Link to Ad Server“ link:

and login to Google by using your Google Ad Manager credentials to generate a token:

After getting a token, copy and paste it to the previous page and press the “Submit” button as shown:

These steps will generate a new ADvendio connection by using a Google Service Account.