Using Advanced Google Services with Service Account

Question

I am developing an application using Google Apps Script and using some Advanced Services such as Admin SDK (Directory API) and Reseller API.

It seems like these API's are being called by my WebApp under context of user who is accessing my WebApp (it's deployed with 'Execute the app as 'User accessing the webapp').

Ideally, I would like these API's calls to be authenticated with some Service Account under my project (in Dev Console). Is it possible? How?

Answer 1

When your scripts are ran as 'User accessing the webapp' it runs off the users data against your quota. If you want to run it against your data you need to change the settings to execute the app as "me".

If you need to do a mixed authentication model where the app needs to access the data of two different accounts, you have some options. Either way one account gets to access the built in Apps Script services and the other will use the REST interfaces to the APIs to access their data.

You can run the app as "me" then manage your own Oauth for the user. This can be done with an OAuth Library such as:

https://github.com/googlesamples/apps-script-oauth2

Or you can run the app as the user and use a service account for your server. Here is a library I put together for using service accounts in Apps Script:

https://github.com/Spencer-Easton/Apps-Script-GSApp-Library