---
title: "Create a Google Service Account to Synchronize Users"
slug: "create-a-google-service-account-to-synchronize-users"
status: "new"
updated: 2026-10-09T11:41:20Z
published: 2026-10-09T11:41:20Z
canonical: "docs.revealdata.com/create-a-google-service-account-to-synchronize-users"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revealdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a Google Service Account to Synchronize Users

Address book synchronization keeps the contacts in Reveal Hold current with your Google Workspace directory. Reveal Hold reads your directory through the Google **Admin SDK API**, using a dedicated service account with domain-wide delegation that is limited to read-only directory access. This follows the same principle as the Okta service account article: a purpose-built account with the minimum permissions needed for synchronization.

Complete the steps in **Integrate with Google Workspace** first — the service account is created inside the same Google Cloud project.

### Create the service account

1. In the **Google Cloud console**, open the project you created for Reveal Hold and go to **IAM & Admin** > **Service Accounts**.
2. Select **+ Create service account**.
3. Enter a **Service account name**, for example “Reveal Hold sync”. The **Service account ID** is generated automatically. Select **Create and continue**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/create-service-account.png)
4. Skip **Permissions (optional)** by selecting **Continue** — the service account does not need any project roles.
5. Skip **Principals with access (optional)** and select **Done**. The service account is created and appears in the list.

### Copy the Unique ID and create a key

1. Select the service account name to open its details.
2. On the **Details** tab, copy the **Unique ID**. You will need it for domain-wide delegation in the next section.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/account-details.png)
3. Go to the **Keys** tab and select **Add key** > **Create new key**.
4. Select **JSON** as the key type and select **Create**. The JSON key file downloads automatically. Save this file securely. You will provide this file to Reveal Support when configuring the integration.

> [!NOTE]
> Note
> 
> Treat the JSON key file like a password: store it securely, share it only through a secure channel, and never commit it to source control. Google’s console shows a recommendation to avoid service account keys where possible; this integration uses a key with read-only directory scopes.

### Grant domain-wide delegation

Domain-wide delegation authorizes the service account to read directory data in your Google Workspace organization. This step requires a **Super Admin** account.

1. Go to **admin.google.com** and sign in as a Super Admin.
2. Go to **Security** > **Access and data control** > **API controls**.
3. Under **Domain wide delegation**, select **Manage Domain Wide Delegation**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/sso-4.png)
4. Select **Add new**.
5. In Client ID, paste the service account’s **Unique ID** you copied earlier.
6. In OAuth scopes, enter: [https://www.googleapis.com/auth/admin.directory.group.readonly](https://www.googleapis.com/auth/admin.directory.group.readonly) and [https://www.googleapis.com/auth/admin.directory.user.readonly](https://www.googleapis.com/auth/admin.directory.user.readonly)
7. Select **Authorize**. The service account now appears in the domain-wide delegation list.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/sso-5.png)

### Enable the Admin SDK API

1. Back in the **Google Cloud console**, go to **APIs & Services** > **Library**.
2. Search for “**Admin SDK API**” and select it in the results.
3. Click **Enable**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/admin-sdk-api.png)

### Assign the Groups Reader role

The service account used for the synchronization needs the **Groups Reader** admin role so that group data can be read through the Admin SDK API. This is the service account provided during Reveal Hold tenant creation.

1. In **admin.google.com**, go to **Directory** > **Users** and select the user.
2. Select **Admin roles and privileges**.
3. Find **Groups Reader** in the roles list, toggle it to **Assigned**, and select **Save**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/group-reader.png)

### Synchronize the address book

1. Once Reveal Hold support the setup, go to **Admin Center > Subscription > Address Book Synchronization**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/google-book-synch.png)
2. Select **Run the Google Contact Synchronization** to start the synchronization.
3. Go to **Configurations > Address Book**.
4. Verify that contacts from your Google directory appear in the Address Book.

See [**Address Book Synchronization**](/reveal-hold-new/docs/address-book-synchronization-1) for more information about scheduling synchronization and managing synchronized contacts.