# Authorization and authentication

We strongly recommend that you use a service account for authentication when you integrate with
the SAS Portal API. If necessary, [create a service account](https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating_a_service_account). Be sure to select JSON as your key type when you [create your service account key](https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys). Once complete, your service account key is downloaded to your
browser's default location. Furthermore, be sure to [grant the "Project Owner" role](https://cloud.google.com/iam/docs/granting-changing-revoking-access) to the service account.

Next, you need to provide your service account authentication as a Bearer token. If you call the
SAS Portal API directly, such as by making an HTTP request with `cURL`, you pass your
authentication as a Bearer token in an `Authorization` header. To obtain a Bearer token
with your service account, follow these steps:

1. [Install the `gcloud` command line tool](https://cloud.google.com/sdk/install).
2. Authenticate to your service account. In the following command, replace
   <var translate="no">${KEY_FILE}</var> with the path to your service account key file:

   ```
   gcloud auth activate-service-account --key-file ${KEY_FILE}
   ```
3. Use your service account to obtain an authorization token:

   ```
   gcloud auth print-access-token
   ```

   The command returns an access token value.
4. When you use the API, pass the token value as a Bearer token in an `Authorization`
   header. See the following example:

   ```
   curl -X GET -H "X-Goog-User-Project: ${CLIENT_PROJECT}" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${TOKEN}" \
   "https://sasportal.googleapis.com/v1alpha1/customers"
   ```

   Set <var translate="no">${CLIENT_PROJECT}</var> to the
   [ID of the Google Cloud Project](https://cloud.google.com/resource-manager/docs/creating-managing-projects) from which you make the requests, and then set
   <var translate="no">${TOKEN}</var> to the authorization token.