Etlworks supports two methods for authenticating with Google APIs: OAuth 2.0 and Google Service Accounts. This article explains how each method works, when to use it, and how to configure your Etlworks connection accordingly.

Authentication Options

1. OAuth 2.0 (Web-Based Authorization)

Use this option when:

• You want to authenticate using your personal or organizational Google account.

• The API requires delegated access on behalf of a user (also known as 3-legged OAuth).

• You need to connect to user-scoped APIs like Google Analytics, Google Sheets, Gmail, etc.

Steps:

1. In the connection settings, set Authentication Type to OAuth2.

2. Click Sign in with Google.

3. Log in with your Google account and authorize the Etlworks app to access the required scopes (e.g., Google Analytics, Sheets).

4. Etlworks will retrieve and store the refresh token securely. It will be used to generate access tokens at runtime.

2. Google Service Account

Use this option when:

• You want server-to-server communication without user interaction.

• You’re connecting to Google APIs that support access via service accounts.

• You need predictable, programmatic access—ideal for backend integrations.

Option A: Use Etlworks’ Default Service Account

Etlworks provides a built-in service account:

etl-framework@api-project-201080624425.iam.gserviceaccount.com

How it works:

• This account is preconfigured and ready to use.

• When the “Service Account” field is left empty, Etlworks uses the default service account automatically.

• Credentials and keys are securely managed internally—no need to upload your own.

Recommended: Use this default account unless you have specific reasons not to.

Option B: Use Your Own Service Account

If needed, you can create and configure your own Google service account.

Why create your own?

• Your organization’s security policy requires it.

• You want to control project-level permissions and quotas in your own GCP environment.

Steps to create and configure:

1. Sign in to your Google Cloud Console.

2. Create a new project (or select an existing one).

3. Go to IAM & Admin > Service Accounts and click Create Service Account.

4. Set up the name and description.

5. After the account is created, click Manage Keys > Add Key > Create New Key.

6. Select JSON as the key type and download the file.

   The downloaded file contains everything Etlworks needs to authenticate.

7. In the Etlworks Google API connection:

   • Upload the JSON key file or copy-paste its content securely.

   • Enter the service account email (usually ending with iam.gserviceaccount.com) if prompted.

Note: The service account email is the unique identifier Google assigns to the service account. Think of it as a username for API access.

Summary: Which Method to Choose?

Related Topics

• Get started with Google Analytics

• Get started with Google Sheets