Using Service Accounts in Google Apps Script for Server-to-Server Auth

Service accounts let server-style code act without a human clicking authorize, critical for nightly ETL and signing JWTs to Google APIs or third parties. In Apps Script, patterns differ from Cloud Run but the crypto is the same.

Domain-wide delegation allows a service account to impersonate Workspace users for Gmail or Drive access, powerful and sensitive. Store private keys in Script Properties or, preferably, pass short-lived tokens from a secure vault.

This article explains when Apps Script alone suffices versus when to keep keys only on Cloud Run. Cross-read /blog/apps-script-oauth2-guide for user-delegated OAuth flows.

Example code

function getServiceAccountToken() {
  const props = PropertiesService.getScriptProperties();
  const clientEmail = props.getProperty('SA_EMAIL');
  const privateKey = props.getProperty('SA_PRIVATE_KEY').replace(/\\n/g, '\n');
  const now = Math.floor(Date.now() / 1000);
  const header = Utilities.base64EncodeWebSafe(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));
  const claim = Utilities.base64EncodeWebSafe(JSON.stringify({
    iss: clientEmail,
    scope: 'https://www.googleapis.com/auth/spreadsheets',
    aud: 'https://oauth2.googleapis.com/token',
    exp: now + 3600,
    iat: now,
  }));
  const sig = Utilities.computeRsaSha256Signature(header + '.' + claim, privateKey);
  const jwt = header + '.' + claim + '.' + Utilities.base64EncodeWebSafe(sig);
  const res = UrlFetchApp.fetch('https://oauth2.googleapis.com/token', {
    method: 'post',
    payload: { grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion: jwt },
  });
  return JSON.parse(res.getContentText()).access_token;
}

FAQ