The [Chrome Web Store API](https://developer.chrome.com/docs/webstore/api.md.txt) supports authentication using Google Cloud
Service Accounts. Service accounts are special, non-human accounts designed for
server-to-server interactions, making them ideal for automating your extension
publishing workflows, such as in CI/CD pipelines or other backend services. They
can allow the API to be used without needing to go through an OAuth flow with
the direct involvement of a user.

By linking a service account to your Chrome Web Store Developer Dashboard, you
grant it authority to manage items owned by your publisher account.

## Setup

First, we'll set up a service account and grant it access to the Chrome Web
Store API.

## Enable the Chrome Web Store API

1. Go to the [Google Cloud Console](https://console.developers.google.com).
2. Create a new project or select an existing one. ![Create a new project in the Google Console.](https://developer.chrome.com/static/docs/webstore/service-accounts/image/create-new-project-t-aef7f7e388f61.png) Create a new project in the Google Console.
3. In the **search bar** type "Chrome Web Store API".
4. Enable the **Chrome Web Store API**.

### Create a service account

![Adding a new service account in the Google Cloud Console.](https://developer.chrome.com/static/docs/webstore/service-accounts/image/create-service-account.png) Adding a new service account in the Google Cloud Console.

[Create a service account](https://console.cloud.google.com/iam-admin/serviceaccounts) in the Google Cloud Console. You don't need to add any permissions to the service account at this stage.

### Add the service account in the Developer Dashboard

> [!NOTE]
> **Note:** At this time, you can only add one service account to your publisher.

![Adding a new service account in the Developer Dashboard.](https://developer.chrome.com/static/docs/webstore/service-accounts/image/service-account.png) Adding a new service account in the Developer Dashboard.

Grant your service account access to the Chrome Web Store API by adding the
service account email in the Developer Dashboard, under the **Account** section.

## Obtain access tokens

To use a service account with the Chrome Web Store API, your application needs
to obtain an access token associated with the service account. There are several
ways to do this, depending on where your application code is running and your
security preferences.

### Service account impersonation

> [!NOTE]
> **Note:** Using `--impersonate-service-accounts` requires the `roles/iam.serviceAccountTokenCreator` role. If you are the owner of the project, you will have this already.

You can use the [`gcloud`](https://cloud.google.com/sdk/docs/install) command-line tool to get a short-lived access
token for your service account. This is often used for local development or CLI
access.

```bash
gcloud auth login --impersonate-service-account=SERVICE_ACCOUNT_EMAIL
gcloud config set project PROJECT_ID
gcloud auth print-access-token --impersonate-service-account=SERVICE_ACCOUNT_EMAIL --scopes=https://www.googleapis.com/auth/chromewebstore
ACCESS_TOKEN=<The output from the last command>
```

Then, make requests as shown in the
[tutorial](https://developer.chrome.com/docs/webstore/using-api.md.txt#setup).

### Use a JSON Web Token

> [!WARNING]
> **Warning:** Managing key files introduces security risks if not handled properly. See [Best practices for managing service account keys](https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys).

Alternatively, you can directly authenticate over HTTP using a JSON Web Token
(JWT). Create a JSON key for your service account in the Google Cloud Console.
![Key creation dialog in Google Cloud Console.](https://developer.chrome.com/static/docs/webstore/service-accounts/image/create-key.png) Key creation dialog in Google Cloud Console.

Then, follow the [steps](https://developers.google.com/identity/protocols/oauth2/service-account#httprest) for constructing a JWT and exchanging it
for an access token.