How can I change the client_email for the service account key credential to my own email?

1
votes

I have 2 applications, the old application is using Oauth2 to access the Google Analytics API. All current users have granted access to an email from my domain.

The second application is using credentials with Service account authentication. The problem is that the email for the Service account keys is using a different domain:

"client_email": "[email protected]",

I need it to use my old email from my domain that already have permissions from clients.

How can I do that, I already downloaded the json file for the Service account keys.

1
google-apigoogle-oauthgoogle-analytics-apiservice-accounts

1 Answers

2
votes

There is a diffrence between Oauth2 and service accounts.

Lets start with the old app using Oauth2. When a user starts using the application they are displayed the authentication form which asks them to grant application X access to their data. Assuming they accept it application X can now read there data. Application X is given a Refresh token which can be used to access the data at a later date.

In the background the developer of Application X registered their application on Google Developer console and was given a client id and client secret. When the user authenticated to the application the Refresh token is created using the client id and client secret. You can not take a different client id and client secret and use it with the refresh token from another application they are not interchangeable.

Service accounts are different in that they are preauthorized. If you take that service account email address you have and add it as a user on the Google analytics website admin section. The service account will have access to read the information just like any other user.

Clarifications / answers.

  1. You can not pick the service account email address these are generated by Google.
  2. You can't use a service account to access data granted to an application though Oauth2. they are not interchangeable.
  3. If you have access to the users data using Oauth2 you should be using your refresh tokens to access their data you do not need a service account.