A service account provides a streamlined way to connect multiple mailboxes to Ebsta with admin input, bypassing the need for users to manually add their mailbox and keep it connected every time they change their password. This makes adding new users easy and allows admins and managers to have confidence that all relevant data is in Ebsta.
Step 1. Create a Project
1. Sign into your Gmail Super administrator account at https://console.developers.google.com/
2. If you have used the GCP Console before, then at the top of the screen next to your most recent project name, click Down to open your projects list. If you haven't used the Console before then you'll need to agree to the Terms of Service first.
2. Then, click New Project.
3. Enter a Project name and click Create. In this example it is called "Gmail Service Account".
Step 2. Enable API Sets
4. From the Drop down menu again make sure your Project is selected and click the ENABLE APIS AND SERVICES.
5. Search for and Enable the following API sets; Gmail API, Google Calendar API & Contacts API. This allows the adding of permission scopes later, but nothing has been granted yet.
The example above shows Gmail, and to get back from the specific API pages click the API & Services Link, and then click the ENABLE APIS AND SERVICES as before.
Step 3. Create a Service Account User
6. In the top-left corner of the GCP console, click Menu . Then select IAM & admin and then Service accounts.
7. Click CREATE SERVICE ACCOUNT.
8. Fill in a name and description for the service account and click CREATE.
9. Grant the Project Owner Role to the service account and click Continue.
10. Click Create Key.
11. Make sure the key is a JSON (It is by default) and select CREATE.
12. The JSON file should be downloaded to your computer you should store this securely as it provides access to your resources. Close the download notification.
13. Once the file is downloaded click DONE to confirm the changes. It is worth copying the Unique ID of the service account into the clipboard for later.
Step 4. Enable G Suite domain-wide delegation
14. Select the newly created Service account and under the Actions select Edit.
15. On the Edit screen click SHOW DOMAIN-WIDE DELEGATION to expand the options.
16. Then tick the checkbox for Enable G Suite Domain-wide Delegation and fill in a Product name.
Then click on the Save Button to save your changes.
Step 5. Enable Service Accounts with Gmail
17. Log into Gmail select the Admin panel you generally will need to scroll down below the More section to find it.
18. Click on the Security panel.
19. Scroll down and then click on Advanced Settings followed by Manage API client access.
20. You now need to set the Client Name and the API Scopes and then click Authorise.
The Client Name is the unique ID of the Service account client (not the Key ID). If you copied this earlier, then you can paste it in below. Otherwise this can be found by clicking Menu in the top left of the GCP console. Then selecting IAM & admin and then Service accounts. Once there click View Client ID and copy and paste the number.
The Access should then be given for the specific API Scopes required, in this case only the following scope is needed. https://www.googleapis.com/auth/gmail.readonly
21. Give it 5 mins for the change to go through the system on Gmail side.
22. You should be all setup to test now with Gmail Service Account and ready to upload your JSON file to Ebsta to connect your Mailboxes, which you can read about how to do in this Knowledge Base article.