Create a Google Play Console Service Account Key

Q: Where do I create a Google Play Console service account?

Create it in Google Cloud Console → IAM & Admin → Service Accounts. Then add its iam.gserviceaccount.com email address under Google Play Console → Users and permissions and assign access to the required apps.

Q: How do I download a Google Play service account JSON key?

Open the service account in Google Cloud Console, select Keys → Add key → Create new key, choose JSON, and click Create. The private credential downloads immediately and cannot be downloaded again later.

Q: Which API should I enable for Google Play Console automation?

Enable the Google Play Android Developer API, whose service name is androidpublisher.googleapis.com, in the Cloud project that owns the service account.

To create a Google Play Console service account key, create or select a Google Cloud project, enable the Google Play Android Developer API, create a service account, invite its email address under Play Console → Users and permissions, assign only the app permissions it needs, then create and download a JSON key from the service account's Keys tab.

The Cloud service account, Play Console permissions, and JSON private key are three separate parts of the setup. Creating only the JSON file does not grant access to your apps, and inviting only the service account in Play Console does not give an external build system credentials it can use. This guide covers the complete current workflow. Google documentation checked September 16, 2026.

What is a Google Play Console service account key?

A service account is a non-human Google identity used by a server, build platform, or release workflow. Instead of asking a person to sign in interactively, the software authenticates as the service account and performs the Google Play actions that you authorized.

The setup includes these components:

Component	Where it lives	What it does
Google Cloud project	Google Cloud Console	Owns the service account and has the Google Play Android Developer API enabled
Service account	Google Cloud IAM	Provides the software identity, with an email ending in `iam.gserviceaccount.com`
Play Console access	Google Play Console	Determines which apps and publishing actions that identity can access
JSON private key	Google Cloud IAM	Lets an external trusted system authenticate as the service account

People often call the downloaded file a “Google Play API key,” but it is technically a service account private key in JSON format. A standard browser API key is not an equivalent credential and cannot simply replace it.

Do you still need to link Play Console to a Google Cloud project?

No. Google's current Android Publisher documentation explicitly says you no longer need to link the developer account to a Google Cloud project to access the Google Play Developer API.

You still need a Cloud project because it owns the service account and the enabled API. You then give the service account access by adding its email address directly under Users and permissions in the Google Play Console.

This distinction matters because many older tutorials send developers to Setup → API access to link a project. Use the current workflow unless the specific Google product or integration you are configuring documents an additional requirement.

What do you need before starting?

Prepare access to both Google systems:

A Google Play Console developer account containing the app you want to manage.
An account owner or administrator who can invite users and change Play Console permissions.
A Google Cloud project you can manage, or permission to create one.
Permission to enable APIs in that Cloud project.
Permission to create service accounts and service account keys.

If the app does not exist in Play Console yet, decide whether the automation needs to create a draft app or whether you will create the app record manually first. App-scoped access is safer when the service account only needs one existing application.

Use a dedicated Cloud project or a clearly named existing project. The project does not have to use the same display name as the Play Console developer account, but a recognizable name makes credential audits easier.

Step 1: Create or select a Google Cloud project.

Open the Google Cloud Console and use the project selector in the top navigation.

You can either:

Select an existing project used for your release infrastructure, or
Choose New Project, enter a descriptive name, select the correct organization or billing parent if applicable, and create it.

Record the Project ID, not only the display name. The downloaded JSON credential will include this value as project_id, and it helps confirm that later steps were completed in the same project.

Creating a project does not connect it to Google Play automatically. It simply establishes the Cloud environment where the API and service account will live.

Step 2: Enable the Google Play Android Developer API.

With the correct Cloud project selected:

Open APIs & Services → Library.
Search for Google Play Android Developer API.
Select the API published by Google.
Click Enable.

The API service name is androidpublisher.googleapis.com. Check the selected project before enabling it; enabling the API in Project A does not help a service account whose JSON key belongs to Project B.

You do not need to enable every Google Play-related API. The Android Publisher API is the primary API for releases, tracks, listings, reviews, purchases, and other supported Play Console operations. Enable additional APIs only when the integration documents a separate dependency.

Step 3: Create the service account.

In the same Google Cloud project:

Open IAM & Admin → Service Accounts.
Click Create service account.
Enter a descriptive name, such as Google Play release automation.
Review the generated service account ID.
Add a description identifying the integration and owner.
Click Create and continue.
Skip optional Google Cloud project roles unless the integration genuinely needs access to other Cloud resources.
Finish the creation flow.

The new identity will have an email similar to:

google-play-release@your-project-id.iam.gserviceaccount.com

Copy that complete email address. You will add it to Play Console as a user in the next step.

Do not grant the service account Google Cloud Owner or Editor merely to make Google Play work. Play Console permissions are separate from Cloud IAM roles. The service account normally needs its publishing authority in Play Console, not broad control over the Cloud project.

Step 4: Add the service account to Google Play Console.

Then:

Open Users and permissions.
Click Invite new users.
Paste the service account email into the email-address field.
Choose whether access applies to specific apps or the entire developer account.
Select the minimum permissions required by the integration.
Click Invite user.

The service account is a software identity, not a human mailbox. Use its exact iam.gserviceaccount.com address. Do not invite your personal Google Account as a substitute when the external system will authenticate with the service account JSON.

Google Play access is independent of Google Cloud IAM. A service account can exist and authenticate successfully with Google, yet receive a 403 from the Android Publisher API because it has not been added to the correct Play Console developer account or app.

Which Google Play Console permissions should you grant?

Grant permissions according to the job the service account performs. Start with access to the specific app rather than every app whenever possible.

Automation task	Relevant Play Console permission
Read basic app information	View app information (read only)
Upload and roll out to internal, closed, or open testing	Release apps to testing tracks
Change testing configuration or tester lists	Manage testing tracks and edit tester lists
Create and roll out a production release	Release to production, exclude devices and use Play app signing
Update descriptions, screenshots, pricing, or distribution	Manage store presence
Edit policy declarations such as Data safety	Manage policy declarations
Create new draft apps at account level	Create, edit and delete draft apps plus account-level read access

A typical release integration for an existing app may need read access and permission to release to the intended track. Production publishing requires the production-release permission; testing-track access alone cannot publish to production.

Avoid Admin (all permissions) unless the service truly needs to manage users and the entire developer account. Do not grant financial-data, order, or subscription permissions to a build system that only uploads Android App Bundles.

After selecting an app under the App permissions tab, click Apply before saving the invitation. Missing that selection is a common reason a valid service account can authenticate but cannot find or update the app.

Step 5: Create and download the service account JSON key.

Return to the Google Cloud Console and verify that the project selected at the top matches the service account's project.

Then:

Open IAM & Admin → Service Accounts.
Click the email address of the service account.
Open the Keys tab.
Click Add key.
Select Create new key.
Choose JSON as the key type.
Click Create.

The browser downloads a .json file immediately. Move it to approved secret storage rather than leaving it in the Downloads folder.

Google does not let you download that private key again. If you lose the file, create a replacement key and remove the lost credential after updating the systems that used it.

The JSON document contains fields such as:

type: normally service_account
project_id: the Cloud project that owns the identity
private_key_id: the identifier of this particular key
private_key: the secret private-key material
client_email: the service account address invited to Play Console
client_id: the identity's numeric client identifier
token_uri: the Google OAuth token endpoint

Do not edit the file, remove line breaks from the private key, or copy only selected fields unless the integration explicitly asks for them separately.

How do you connect the JSON key to a build platform?

A trusted build or publishing service will normally provide a protected field to upload the complete service account JSON file. Before uploading it:

Confirm the project_id belongs to the project where you enabled the Android Publisher API.
Confirm client_email exactly matches the service account added in Play Console.
Confirm that Play Console access applies to the correct app package.
Confirm the permissions cover the requested release track but nothing unrelated.
Verify the domain and security documentation of the service receiving the credential.

Do not paste the JSON into website JavaScript, include it in an Android app, upload it as a public project asset, or send it through an ordinary support conversation. Anyone who obtains the file can authenticate as the service account until the key is disabled or deleted.

Some platforms support Workload Identity Federation or another short-lived authentication method instead of a downloadable private key. Google recommends keyless authentication when it is practical. Use a JSON key only when the integration requires service account credentials and can store them securely.

How do you verify that the setup is complete?

Before relying on the service account for a release, confirm all four layers:

Cloud project: The Project ID matches the JSON file.
API: androidpublisher.googleapis.com is enabled in that project.
Identity: The JSON client_email matches an active service account.
Authorization: That email has access to the target app and required actions in Play Console.

Run a low-risk operation through the integration first, such as listing the app or reading release-track information. Then test an internal-track upload before enabling production publishing.

Permission changes and new keys can take a short time to propagate. Google's IAM documentation notes that a newly created service account key may require at least 60 seconds before it works. Retry after a brief delay before recreating every credential.

Why does the service account receive a 403 error?

A 403 usually means Google recognized the identity but it lacks authorization for the requested Play Console resource or action.

Check these items:

The service account email was added to the correct Play Console developer account.
The target app was selected under App permissions.
View app information is enabled when the integration needs to locate the app.
The correct release permission is enabled for testing or production.
The package name in the request exactly matches the app in Play Console.
The permission change has finished propagating.

If the service can upload to internal testing but fails in production, it probably has Release apps to testing tracks but not Release to production, exclude devices and use Play app signing.

Do not solve every 403 by granting global Admin access. Identify the failed operation and add the corresponding app-level permission where possible.

Why does Google say the Android Publisher API is disabled?

The service account may belong to a different project from the one where you enabled the API.

Open the JSON file only in a secure local editor and check its project_id. Select that exact project in Google Cloud Console, open the Google Play Android Developer API, and confirm that its status is enabled.

If the error says the API has never been used in the project, follow the project-specific link in the error, enable the API, wait briefly, and retry. Creating the service account does not enable the Android Publisher API automatically.

Why is Create new key disabled or blocked?

Several controls can prevent key creation:

Your user does not have permission to manage service account keys.
An organization policy enforces iam.disableServiceAccountKeyCreation.
The service account already has the maximum number of keys.
Your organization requires a keyless authentication method.

Google states that organizations created on or after May 3, 2024 have the service-account-key creation constraint enforced by default. Do not weaken an organization-wide security policy without approval. Ask the Cloud administrator whether the project can receive a narrowly scoped exception or whether the integration supports Workload Identity Federation.

To create or delete keys, a user commonly needs the Service Account Key Admin role or equivalent permissions on the service account or project. Being a Play Console administrator does not automatically grant Google Cloud IAM authority.

What should you do if the JSON key is lost?

Google cannot provide another copy of the same private key. Create a new key on the existing service account, update the trusted integration, confirm that it works, then disable and delete the lost key.

If you believe the file may have been exposed rather than merely lost, disable or delete it immediately. Removing Play Console access from the service account blocks its publishing authority, while disabling or deleting the specific Cloud key blocks authentication with that credential.

Deleting the entire service account is usually unnecessary when only one key is affected. One service account can have multiple keys, although maintaining several long-lived credentials increases risk and complicates audits.

How should you secure a Google Play service account key?

Treat the JSON file as a production password:

Create a dedicated service account for each external integration.
Grant access only to the apps it needs.
Use the minimum Play Console permissions for its task.
Store the JSON in a secrets manager or encrypted credential store.
Never commit it to Git, even in a private repository.
Never place it in an Android app, web frontend, downloadable asset, or container image layer.
Record the owner, purpose, creation date, and connected systems.
Review active service-account users in Play Console regularly.
Disable and delete unused or compromised keys.
Prefer short-lived or keyless authentication when the provider supports it.

Google Cloud allows multiple keys on one service account, but separate service accounts usually give cleaner isolation. If one provider is compromised or discontinued, you can remove its Play Console access without interrupting another release system.

Google Play Console service account FAQ

Where do I create a Google Play Console service account?

Create it in Google Cloud Console → IAM & Admin → Service Accounts. Then add its iam.gserviceaccount.com email address under Google Play Console → Users and permissions and assign access to the required apps.

How do I download a Google Play service account JSON key?

Open the service account in Google Cloud Console, select Keys → Add key → Create new key, choose JSON, and click Create. The private credential downloads immediately and cannot be downloaded again later.

Do I need to link my Google Cloud project to Play Console?

No. Google's current Android Publisher setup says developer accounts no longer need to be linked to a Cloud project. Enable the API in the project, create the service account, and add its email directly to Play Console Users and permissions.

Which API should I enable for Google Play Console automation?

Enable the Google Play Android Developer API, whose service name is androidpublisher.googleapis.com, in the Cloud project that owns the service account.

Which permissions does a service account need to upload an AAB?

For an existing app, it generally needs app visibility plus permission to release to the intended track. Use Release apps to testing tracks for internal, closed, or open testing. Production rollout requires Release to production, exclude devices and use Play app signing.

Does a service account need Google Cloud Owner or Editor?

Not for ordinary Google Play publishing. Cloud IAM and Play Console permissions are separate. Avoid broad Cloud project roles unless the integration also needs specific Cloud resources outside the Android Publisher API.

Why can the service account not find my app?

The service account may be in the wrong Play Console developer account, may lack app-level access, or may be using an incorrect package name. Add the target app under App permissions and grant at least the required read access.

Can I download the same JSON private key twice?

No. Google provides the private key only when it is created. If the downloaded file is lost, generate a replacement key and remove the missing credential after updating your integration.

Is a Google API key the same as a service account JSON key?

No. A typical Google API key identifies a project for supported API requests. A service account JSON file contains private credentials that let server software authenticate as an authorized service identity. Google Play publishing integrations generally require the service account flow.

Can the service account access only one app?

Yes. In Play Console, add the service account under Users and permissions, choose App permissions, and select only the relevant app. Use account-level permissions only when the workflow truly needs every app or must create new draft apps.

Is it safe to send the JSON key to a third-party platform?

Only provide it to a trusted platform through protected credential storage after reviewing why it needs access. Create a dedicated service account, restrict it to the required app and permissions, and revoke its key and Play Console access when the integration is no longer used.

Official Google sources for service accounts and Play Console access.

Continue your Google Play release setup.

Turn your web app into a Google Play-ready Android project.

WebNativeApp helps package your existing production website as an Android project, prepare its app identity and mobile behavior, and organize the release path to testing and Google Play. You keep control of the web product, Android source project, and Play Console developer account.