Skip to main content
Server-to-server auth without user interaction. No OAuth consent flow needed. Ideal for backend services, cron jobs, or multi-tenant apps.
service_account.py
"""
Google Service Account Authentication
======================================

Server-to-server auth without user interaction. No OAuth consent flow needed.
Ideal for backend services, cron jobs, or multi-tenant apps.

When to use Service Account vs OAuth:
  - Service Account: Your server accesses Google APIs on behalf of users
  - OAuth: Users grant access to their own Google data interactively

Authentication (env vars):
  GOOGLE_SERVICE_ACCOUNT_FILE - Path to service account JSON key file
  GOOGLE_DELEGATED_USER       - Email of user to impersonate (required for Gmail)

Setup:
  1. Google Cloud Console -> IAM & Admin -> Service Accounts -> Create
  2. Download JSON key file
  3. For Gmail: Enable domain-wide delegation in Google Workspace Admin
     (Admin Console -> Security -> API Controls -> Domain-wide Delegation)
  4. Set GOOGLE_SERVICE_ACCOUNT_FILE and GOOGLE_DELEGATED_USER env vars

Run:
  .venvs/demo/bin/python cookbook/91_tools/google/google_service_account.py
"""

from os import getenv

from agno.agent import Agent
from agno.models.openai import OpenAIResponses
from agno.tools.google.auth import AuthConfig
from agno.tools.google.calendar import GoogleCalendarTools
from agno.tools.google.drive import GoogleDriveTools
from agno.tools.google.gmail import GmailTools
from agno.tools.google.sheets import GoogleSheetsTools

# ---------------------------------------------------------------------------
# Service Account Auth Config
# ---------------------------------------------------------------------------
# No OAuth consent needed — credentials come from the JSON key file.
# service_account_path and delegated_user are on AuthConfig

auth = AuthConfig(
    service_account_path=getenv("GOOGLE_SERVICE_ACCOUNT_FILE"),
    delegated_user=getenv("GOOGLE_DELEGATED_USER"),
)

agent = Agent(
    name="Workspace Agent",
    model=OpenAIResponses(id="gpt-5.5"),
    tools=[
        GmailTools(auth=auth),
        GoogleCalendarTools(auth=auth),
        GoogleDriveTools(auth=auth),
        GoogleSheetsTools(auth=auth),
    ],
    add_datetime_to_context=True,
    markdown=True,
)

if __name__ == "__main__":
    if not getenv("GOOGLE_SERVICE_ACCOUNT_FILE"):
        print("Set GOOGLE_SERVICE_ACCOUNT_FILE and GOOGLE_DELEGATED_USER env vars")
    else:
        agent.print_response(
            "List my recent emails and today's calendar events", stream=True
        )

​
Run the Example

1

Set up your virtual environment

uv venv --python 3.12
source .venv/bin/activate

uv venv --python 3.12
.venv\Scripts\activate
2

Install dependencies

uv pip install -U agno google-api-python-client google-auth google-auth-httplib2 google-auth-oauthlib openai openpyxl python-docx python-pptx
3

Export your API keys

export GOOGLE_CLIENT_ID="your_google_client_id_here"
export GOOGLE_CLIENT_SECRET="your_google_client_secret_here"
export GOOGLE_CLOUD_QUOTA_PROJECT_ID="your_google_cloud_quota_project_id_here"
export GOOGLE_TOKEN_ENCRYPTION_KEY="your_google_token_encryption_key_here"
export OPENAI_API_KEY="your_openai_api_key_here"

$Env:GOOGLE_CLIENT_ID="your_google_client_id_here"
$Env:GOOGLE_CLIENT_SECRET="your_google_client_secret_here"
$Env:GOOGLE_CLOUD_QUOTA_PROJECT_ID="your_google_cloud_quota_project_id_here"
$Env:GOOGLE_TOKEN_ENCRYPTION_KEY="your_google_token_encryption_key_here"
$Env:OPENAI_API_KEY="your_openai_api_key_here"
4

Run the example

Save the code above as service_account.py, then run:
python service_account.py
Full source: cookbook/91_tools/google/workspace/service_account.py