- About This Article
- In a Nutshell
- Where Do They Stand in Google's Ecosystem?
- Organizing Terminology for Beginners
- How Does OAuth 2.0 Flow Work?
- How Does a Service Account Flow Work?
- Comparing OAuth 2.0 and Service Accounts
- How to Choose Based on Your Role
- How Should Microsoft Users Think About This?
- API Keys Are Something Else Entirely
- Try It Safely: Check ADC Status
- What Never to Store on GitHub
- Common Misconceptions
- Pricing, Accounts, and Projects
- How Do They Actually Work Together?
- Official Information and Primary Sources
- Papanda TRY: Visually Comparing OAuth Scopes
- What Kind of Service Is It Ultimately?
About This Article
About This Article
This article was created using an automated generation workflow leveraging generative AI. Based on official primary sources from Google Identity and Google Cloud IAM, it organizes OAuth 2.0 and Service Accounts around an easy-for-beginners axis: "whose authority and what does it access?"
Information Verification Reference Date: September 19, 2026
Google's authentication methods, recommended configurations, and official URLs are subject to change. This article verifies official information as of the reference date above.
Verification Status: Google Identity and Google Cloud IAM official information verified as of September 19, 2026.
In a Nutshell
When using Google APIs, similar terms like OAuth 2.0, Service Accounts, API Keys, and Access Tokens all appear at once. There is one key point to remember first.
OAuth 2.0: A mechanism where a user permits an app, saying, "Allow this app to use my data up to this point."
Service Account: An ID assigned to non-human processes, such as servers or batch processing.
In other words, it's not a question of which one is superior, but rather as whom are you calling the API that differs.
Where Do They Stand in Google's Ecosystem?
| Perspective | Positioning |
|---|---|
| Broad Category | Google API / Google Cloud / Identity |
| Classification | Authentication and Authorization Infrastructure |
| Primary Purpose | Ensuring that only "authorized entities" can securely use APIs |
| Role of OAuth 2.0 | Granting limited access permissions from users to apps |
| Role of Service Account | Assigning an ID to workloads such as apps, VMs, and batch jobs |
| Used Together With | Google Cloud Projects, IAM, OAuth Scopes, Access Tokens, ADC, and individual Google APIs |
Rather than being services that complete tasks on their own, these two are foundational building blocks for securely using Gmail, Calendar, Drive, Google Cloud, and more via APIs.
flowchart LR
USER[利用者] --> APP[アプリ]
APP --> AUTH{誰としてアクセス?}
AUTH -->|利用者の許可を受ける| OAUTH[OAuth 2.0]
AUTH -->|アプリ自身として動く| SA[Service Account]
OAUTH --> TOKEN[Access Token]
SA --> CRED[短期資格情報]
TOKEN --> API[Google API]
CRED --> API
IAM[IAM / 対象サービスの権限] --> API
Organizing Terminology for Beginners
Authenticationis the process of verifying "Who are you?" Think of it as logging in to confirm your identity.
Authorizationdetermines "What is that person or app allowed to do?" Even if identity is confirmed, it doesn't mean all data can be read.
OAuth 2.0is a standard mechanism primarily for authorization. Instead of passing passwords directly to apps, it allows granting limited permissions, such as "only permit reading the calendar."
Service Accountis an ID managed in Google Cloud for applications or computational processes rather than humans.
Access Tokenis a short-term pass presented to an API to show that "permission has been granted."
Scoperepresents the range indicating "how far permission is requested" in OAuth.
How Does OAuth 2.0 Flow Work?
sequenceDiagram participant U as 利用者 participant A as アプリ participant G as Google認可画面 participant API as Google API U->>A: 機能を使う A->>G: 必要なScopeで認可を要求 G->>U: このアクセスを許可しますか？ U->>G: 許可 G-->>A: Authorization Code A->>G: CodeをTokenへ交換 G-->>A: Access Token A->>API: Access Token付きでAPI呼び出し API-->>A: 許可範囲のデータ
In web applications, the flow generally works like this. Because implementation methods vary by application type, Google officially recommends using provided authentication libraries rather than building custom OAuth endpoints.
How Does a Service Account Flow Work?
sequenceDiagram participant W as バッチ/サーバー participant ID as Service Account participant IAM as IAM participant API as Google Cloud API W->>ID: 実行環境に関連付けたIDを利用 ID->>IAM: 必要な権限を確認 IAM-->>W: 短期資格情報 W->>API: 資格情報付きでAPI呼び出し API-->>W: 許可された処理結果
On Google Cloud, a typical approach is associating a Service Account with a execution resource to use short-term credentials. Workload Identity Federation is also an option for external environments.
While Service Account JSON keys can be used, Google highlights security risks when keys cannot be managed properly and advises prioritizing safer alternatives whenever possible.
Comparing OAuth 2.0 and Service Accounts
| Perspective | OAuth 2.0 User Authorization | Service Account |
|---|---|---|
| Principal | Google User | Application / Workload |
| Human Login / Consent | Usually Yes | Usually No |
| Primary Use Case | Accessing user-owned data | Backend / Automated processing |
| Permissions | Scope + User/Service-side permissions | Permissions granted via IAM or target services |
| Credentials | Access Token, and Refresh Token in some cases | Short-term credentials, Access Tokens, etc. |
| Long-lived Keys | Configurations involving Client Secrets exist | JSON keys are possible, but alternative methods are preferred |
The important point is that "it is automated, so it must be a Service Account" is not true. Decisions are made by checking the authentication specifications of each API and whose data is being accessed.
How to Choose Based on Your Role
General Users / Administrative Staff
For example, for a tool that organizes your Google Calendar events into Excel or CSV, OAuth 2.0 is an easy-to-understand example: "permitting this tool to read my events." It is crucial to check whether the permissions requested on the consent screen are broader than necessary.
IT Administrators
Rather than creating numerous Service Accounts, managing who can use which Service Account and what they can access via IAM is what matters. Avoid distributing long-lived JSON keys carelessly, and prioritize least privilege and short-term credentials.
Developers
First, decide between "user delegation" or "workload identity." Next, check the authentication methods supported by the target API, required Scopes/IAM Roles, and execution environment. Using Application Default Credentials (ADC) with Google Cloud client libraries helps design environments where authentication code doesn't need to be rewritten.
How Should Microsoft Users Think About This?
| Google Side | Closest Concept on Microsoft Side | Similarities | Key Differences to Note |
|---|---|---|---|
| OAuth 2.0 User Authorization | Microsoft identity platform delegated permissions | Users delegate limited permissions to applications | Scope names, consent screens, and per-API permission structures differ |
| Service Account | Close to Microsoft Entra workload identity / service principal | ID for non-human apps and processes | Google Service Accounts and Entra service principals are not the same concept or management model |
| IAM Role | Close to Azure RBAC, etc. | Managing resource permissions through roles | Permission hierarchies, roles, and target service designs differ |
Rather than equating "Service Account = Microsoft's X," it is safer to understand it through the shared mindset of assigning IDs and minimum required permissions to non-human processes.
API Keys Are Something Else Entirely
API keys are used to identify the project or application calling an API, but their role differs from user consent like OAuth or workload principals like Service Accounts. Availability and restriction methods must be checked per API.
Try It Safely: Check ADC Status
Application Default Credentials (ADC) are widely used in Google Cloud client libraries. ADC automatically discovers credentials available from the execution environment.
A representative command to configure user credentials for ADC in local development is as follows.
gcloud auth application-default login
What to Look For? Verify that browser authentication completes and local credentials for ADC are created.
Success Criteria? ADC-compatible client libraries can subsequently discover authentication information without embedding tokens directly in code.
If You Were to Change One Thing?Do not bring this local user authentication directly into production environments; instead, consider Service Accounts attached to execution resources on Google Cloud, or Workload Identity Federation in external environments.
Furthermore, local files generated for ADC also contain credentials. Do not commit them to GitHub.
What Never to Store on GitHub
credentials.json
token.json
OAuth Client Secrets
Service Account JSON keys
Private keys
Access Tokens
Refresh Tokens
Actual account IDs or email addresses
Sample code should use fictional values like YOUR_PROJECT_ID、YOUR_PROPERTY_ID.
Common Misconceptions
Which is superior: OAuth or Service Accounts?
There is no superiority. They have different subjects and purposes.
Can any task be automated using a Service Account?
No. You must verify which authentication methods each Google API accepts and what permission grants are required on the target service side. Google Workspace and other services also have service-specific authorization rules.
Is creating a JSON key the easiest approach?
Even when possible, long-lived keys carry leakage risks. Prioritize architectures that reduce long-lived keys, such as attached service accounts on Google Cloud or Workload Identity Federation in external environments.
Pricing, Accounts, and Projects
| Item | Concept |
|---|---|
| Google Account | Required as the target user for OAuth user authorization |
| Google Cloud Project | Often required for OAuth clients, Service Accounts, and Google Cloud API usage |
| OAuth 2.0 Pricing | Rather than a flat fee for the authorization method itself, check the pricing terms of the API/service being used |
| Service Account Itself | Check pricing and quota conditions for the Google Cloud resources/APIs being used |
Because pricing and offering terms change, please verify the pricing pages of individual APIs as of the reference date.
How Do They Actually Work Together?
OAuth 2.0 and Service Accounts are essential components for determining "as whom to access" when using Google APIs securely.
Humans permitting apps to use their data → OAuth 2.0
Servers or batch jobs operating under their own ID → Service Account
Separating these first makes it easier to understand subsequently introduced terms like Scopes, Access Tokens, IAM, and ADC.
Official Information and Primary Sources
Google Identity — Using OAuth 2.0 for Web Server Applications
Google Cloud — Authentication for Google Cloud APIs and services
Papanda TRY: Visually Comparing OAuth Scopes
Make this a Daily Code candidate that uses browser cards to compare fictional read-only and write scopes side by side, visualizing how granting more operations broadens the permission range. Avoid actual client secrets or tokens, and practice choosing least privilege.
What Kind of Service Is It Ultimately?
"What is the difference between OAuth 2.0 and Service Accounts? Organizing Google API Authentication" is a Google service that is easy to understand by grasping the roles, use cases, and precautions covered in this article, and testing them on a small scale while checking official primary sources.
