To ensure data security, enforce access control, and maintain system integrity,
you must authenticate all Merchant API requests. The API uses the authenticated
identity to determine the actions the caller has permission to perform. For
example, some callers might have read-only access to product data, while others
can modify account settings in the Merchant Center.


This document is part of a multi-part series about getting started with
Merchant API. If you already have authentication set up with Merchant API, you
can skip to the next section:
[Register as a developer](https://developers.google.com/merchant/api/guides/quickstart/registration)

## Authorize requests to Merchant API

Every request sent to the Merchant API must include an authorization token to
identify your application to Google. To set up authentication and authorization,
decide on the use case that best describes the way you plan to work with the
Merchant API:

### Are you building an application for other businesses to use?

If yes, you use **OAuth 2.0** authorization. Choose OAuth 2.0 authorization if:

- **You are a third-party provider or agency**: You are building an application, such as a SaaS platform, that will be used by other businesses to manage their own Merchant Center data.
- **You need to manage many external accounts**: You want a single application to work across multiple, independent Merchant Center accounts owned by different clients. Your clients grant permissions by signing into their own Google Accounts and clicking "Allow" on a consent screen.

### Are you building an app for your own business?

If yes, you use a **service account authorization** to get Merchant API access.
Choose a service account authorization if:

- **You are building your own in-house application**: You are developing a tool specifically for your own business to manage your own Merchant Center data , or you want the credentials to belong to the application itself rather than a specific individual user.
- **You need automation without human login**: Your application runs background tasks such as automated inventory updates or "cron" jobs.

## OAuth 2.0 authorization

If you're a third-party provider or agency managing multiple client accounts,
your application must use OAuth 2.0 to authorize requests. Follow these steps to
set up OAuth 2.0 for Merchant API:

1. **Create OAuth 2.0 credentials** in [APIs and Services](https://console.cloud.google.com/apis/credentials) in your Google Cloud console
2. Download the **OAuth2 client credentials** to the file such as `client-secrets.json`
3. **Add the email account as a user to Merchant Center** : Make sure that the Google Account you use to authorize requests exists as a user in the Merchant Center. See [How to add or remove a user from Merchant Center](https://support.google.com/ads-help/answer/9040732) for more details
4. Assign it the `Admin` role to perform registration. For more information about roles, see [Manage people and access levels in Merchant Center](https://support.google.com/merchants/answer/12160472)
5. **Setup authentication with code samples** : Follow the guidance from the official code samples [Setting up Authentication and Sample Configuration
   documentation section](https://github.com/google/merchant-api-samples/blob/main/README.md#setting-up-authentication-and-sample-configuration)

For more information about **OAuth 2.0** authorization, see
[Authorize third-party app access to Merchant Center account](https://developers.google.com/merchant/api/guides/authorization/access-client-accounts)
and
[Using OAuth 2.0 to Access Google APIs](https://developers.google.com/identity/protocols/oauth2).

## Service account authorization

You use a [service account](https://docs.cloud.google.com/iam/docs/service-account-overview) to authorize Merchant API access to
your own Merchant Center account. Follow these steps to set up service
account authorization for Merchant API:

1. **Create service account credentials in** [APIs and Services](https://console.cloud.google.com/apis/credentials) in your Google Cloud console
2. **Download the private key** : Create and download the private key in JSON format for the service account. Rename the file to `service-account.json`
3. **Add the service account to Merchant Center** : Copy the unique service account email address such as `sa@project.iam.gserviceaccount.com` and add it as a new user in your Merchant Center. See [How to add or remove a user
   from Merchant Center](https://support.google.com/ads-help/answer/9040732) for more details
4. Assign it `Admin` access. For more information about access levels, see [Manage people and access levels in Merchant Center](https://support.google.com/merchants/answer/12160472)
5. **Setup authentication with code samples** : Follow the guidance from the official code samples [Setting up Authentication and Sample Configuration
   documentation section](https://github.com/google/merchant-api-samples/blob/main/README.md#setting-up-authentication-and-sample-configuration)

For more information about **service account** authorization, see [Authorize
access to your Merchant Center account](https://developers.google.com/merchant/api/guides/authorization/access-your-account) and [Service accounts
overview](https://docs.cloud.google.com/iam/docs/service-account-overview).