Get Google Authorization Bearer Token

Audience: Low-code Engineers

Skill Prerequisites: Actions, Connectors, Google Cloud

Gets an OAuth 2.0 access token from Google for a service account, and saves it in a token. Use the token in the Authorization header of a Server Request to call Google APIs, such as Drive, Sheets, Calendar or the Admin SDK.

note

This action is part of the Google Cloud add-on, which is installed and licensed separately (feature package GOOGL). If it isn't licensed, the action fails with a not-licensed error.

Typical Use Cases

• Read or write a Google Sheet from a form or workflow
• Upload a generated file to Google Drive
• Create events in a shared Google Calendar
• Manage Google Workspace users with the Admin SDK, by impersonating an administrator

Don't use it to

• Call Google APIs that only accept an API key. Pass the key in the Server Request instead.

Related Actions

Action Name	Description
Server Request	Calls the Google API with the token in the Authorization header.
Add Connector	Adds a Google Service Account connector from actions.
Test Connector	Doesn't support Google Service Account connectors. Run this action to check the connector instead.

Setting up the connector

1. In the Google Cloud console, create a service account and download a key for it in JSON format.
2. Enable the Google APIs you want to call for the project.
3. In Plant an App, add a connector of type Google Service Account, and paste the whole JSON key into Service Account JSON. The key is stored encrypted. See Connectors.
4. To use Impersonation, a Google Workspace administrator must grant the service account domain-wide delegation for the same scopes you request.

Input Parameter Reference

Parameter	Description	Supports Tokens	Default	Required
Google Service Account	The Google Service Account connector to use.	Yes	empty	Yes
Google Scopes	The Google scopes to request, one per line, for example https://www.googleapis.com/auth/spreadsheets. Blank lines and spaces around each scope are ignored.	Yes	empty string	Yes
Impersonation	The email address of a Google Workspace user to act as, usually an administrator. Some APIs, such as the Admin SDK Directory API, need this. Leave it empty to act as the service account itself.	Yes	empty string	No

Output Parameters Reference

Parameter	Description
Output Token Name	The name of the token that receives the access token, for example GoogleToken. Use it as Bearer [GoogleToken] in the Authorization header.

Considerations

• The token expires, usually after an hour. The action gets a new token every time it runs, so run it just before the requests that need it.
• Keep the token out of logs and pages. Anyone who has it can call the API with the service account's access until it expires.
• Ask for the smallest scopes you need, for example a .readonly scope when you only read data.
• Errors come from Google. A wrong scope, a disabled API or missing domain-wide delegation makes the action fail with Google's error message.
• A service account isn't a user. Without impersonation, it only sees files, sheets and calendars that were shared with the service account's email address.

Examples

tip

To understand how to use the below examples, please see Running Examples.

1. Read a Google Sheet

The first action gets a read-only token. The second reads a range of a sheet with it. Pick your connector in Google Service Account after importing, and replace [SpreadsheetId] with your sheet's ID.

[
    {
        "Title": "Get Google Authorization Bearer Token",
        "ActionType": "GoogleGetAuthorizationToken",
        "Description": "Get a token for reading Google Sheets",
        "Parameters": {
            "Scopes": "https://www.googleapis.com/auth/spreadsheets.readonly",
            "Impersonation": "",
            "OutputTokenName": "GoogleToken"
        }
    },
    {
        "Title": "Server Request",
        "ActionType": "ServerRequestHttpClient",
        "Description": "Read the Orders sheet",
        "Parameters": {
            "URL": "https://sheets.googleapis.com/v4/spreadsheets/[SpreadsheetId]/values/Orders!A1:D100",
            "HttpMethod": "GET",
            "Headers": [
                {
                    "name": "Authorization",
                    "value": "Bearer [GoogleToken]"
                }
            ],
            "OutputTokenName": "SheetResponse"
        }
    }
]

2. List Google Workspace users

This action gets a token for the Admin SDK Directory API, acting as an administrator. The service account needs domain-wide delegation for this scope.

{
    "Title": "Get Google Authorization Bearer Token",
    "ActionType": "GoogleGetAuthorizationToken",
    "Description": "Get a token for the Directory API",
    "Parameters": {
        "Scopes": "https://www.googleapis.com/auth/admin.directory.user.readonly",
        "Impersonation": "admin@example.com",
        "OutputTokenName": "GoogleAdminToken"
    }
}

Revised 09/27/2026