---
title: "GCP Service Account"
slug: "gcp-service-account"
updated: 2026-07-14T10:18:00Z
published: 2026-07-14T10:18:00Z
canonical: "docs.dataddo.com/gcp-service-account"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataddo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Service Account

The Google Platform Service Account authorizer lets Dataddo authenticate with a Google Cloud service account instead of a personal Google account. You create a service account in your Google Cloud project, download its JSON key file, and upload it to Dataddo. There is no interactive sign-in and no dependency on any employee's account.

## How It Works

Dataddo uses the uploaded key to obtain a short-lived, Google-signed identity token. The URL you enter in the authorizer becomes the token's audience, and Dataddo attaches the token as a Bearer header to every request it sends there. Your service must accept Google-signed identity tokens for that URL. Tokens are refreshed automatically before they expire.

## Create the Service Account in Google Cloud

1. In the Google Cloud Console, select your project.
2. Go to **IAM & Admin** and choose **Service Accounts**.
3. Create a new service account (or open an existing one) and grant it the access your service requires.
4. Open the service account's **Keys** tab, create a new key of type JSON, and download the file.

## Upload the Key to Dataddo

1. In Dataddo, go to **Settings > Security** and open the **Certificates and Tokens** section.
2. Upload the JSON key file you downloaded from Google Cloud.

## Create the Authorizer in Dataddo

1. Go to **Authorizers** and click **Authorize New Service**.
2. Search for and select **Google Platform Service Account**.
3. Fill in the fields:

| Field | Description |
| --- | --- |
| Label | A name for this authorizer in Dataddo. |
| URL | The URL of your service. It is used as the audience of the identity token, and Dataddo sends its requests there. |
| Configuration file | The JSON key file you uploaded under Certificates and Tokens. |

1. Click **Save**. Dataddo immediately calls the URL with a fresh token to validate the setup. The authorizer is not created if the service rejects the token with a 401 or 403 response.

## Where You Can Use It

Use this authorizer where Dataddo calls a service of yours that validates Google-signed identity tokens. It is also available for Google Sheets sources and destinations.

## Troubleshooting

**Saving the authorizer fails with 401 or 403**

- Check that the URL is correct and that your service accepts Google-signed identity tokens with that URL as the audience.
- Check that the service account has access to the target service.
- Check that you selected the right key file and that the key has not been deleted or disabled in Google Cloud.