The Google Platform Service Account authorizer lets Dataddo authenticate with a Google Cloud service account instead of a personal Google account. You create a service account in your Google Cloud project, download its JSON key file, and upload it to Dataddo. There is no interactive sign-in and no dependency on any employee's account.
How It Works
Dataddo uses the uploaded key to obtain a short-lived, Google-signed identity token. The URL you enter in the authorizer becomes the token's audience, and Dataddo attaches the token as a Bearer header to every request it sends there. Your service must accept Google-signed identity tokens for that URL. Tokens are refreshed automatically before they expire.
Create the Service Account in Google Cloud
- In the Google Cloud Console, select your project.
- Go to IAM & Admin and choose Service Accounts.
- Create a new service account (or open an existing one) and grant it the access your service requires.
- Open the service account's Keys tab, create a new key of type JSON, and download the file.
Upload the Key to Dataddo
- In Dataddo, go to Settings > Security and open the Certificates and Tokens section.
- Upload the JSON key file you downloaded from Google Cloud.
Create the Authorizer in Dataddo
- Go to Authorizers and click Authorize New Service.
- Search for and select Google Platform Service Account.
- Fill in the fields:
| Field | Description |
|---|---|
| Label | A name for this authorizer in Dataddo. |
| URL | The URL of your service. It is used as the audience of the identity token, and Dataddo sends its requests there. |
| Configuration file | The JSON key file you uploaded under Certificates and Tokens. |
- Click Save. Dataddo immediately calls the URL with a fresh token to validate the setup. The authorizer is not created if the service rejects the token with a 401 or 403 response.
Where You Can Use It
Use this authorizer where Dataddo calls a service of yours that validates Google-signed identity tokens. It is also available for Google Sheets sources and destinations.
Troubleshooting
Saving the authorizer fails with 401 or 403
- Check that the URL is correct and that your service accepts Google-signed identity tokens with that URL as the audience.
- Check that the service account has access to the target service.
- Check that you selected the right key file and that the key has not been deleted or disabled in Google Cloud.