This article is written for Windows, but the same principles apply to Linux and Mac.

A service account is a special Google account that is used with applications or services, such as, Google Compute Engine. Service account credentials are stored in a file. There are two file formats, Json and P12.

The Json format is the recommended format for service account credential files. This format consists of multiple Json keys, with the private key being the critical value which is used to sign API requests. This file can be viewed in any text editor.

  "type": "service_account",
  "project_id": "development-123456",
  "private_key_id": "01234567890abcdefghic46fb305abcdefghijkl",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBg
<removed content for security>
mUTxqeO6EH4qnCsaOWCZw==\n-----END PRIVATE KEY-----\n",
  "client_email": "",
  "client_id": "111012345678912345678",
  "auth_uri": "",
  "token_uri": "",
  "auth_provider_x509_cert_url": "",
  "client_x509_cert_url": ""

The P12 format, otherwise known as PKCS #12 or PFX, is a binary format for storing a certificate, intermediate certificates and the private key in an encrypted file. Common file suffixes are .p12 or .pfx. The following openssl command will display a P12 file. Note the option -nodes. This means No DES, not NODES. Use this option so that you can see the unencrypted private key. In this example the password is notasecret.

openssl pkcs12 -info -nodes -in test.p12 -passin pass:notasecret

Now let’s create a service account using the gcloud CLI. First, let’s set some environment variables to reduce mistakes. Modify with your Google Project ID.

set PROJECT=development-123456
set USER=test100
set FILE=test100.json


Notice the MEMBER variable. The format for service account credentials is always USER@PROJECT suffixed with the domain

This command will display the current Project ID:

gcloud config list project --format=json
  "core": {
    "project": "development-123456"

To get fancy using jq:

gcloud config list project --format=json | jq -r ".core.project"



Using jq makes it easy to set environment variables to chain commands together.

Create a service account using the previous environment variables:

set PROJECT=development-123456
set USER=test100
set FILE=test100.json


gcloud iam service-accounts create %USER%

Command output:

Created service account [test100].

The next step is to authorize the service account with permissions. In this example, we authorize the role viewer:

gcloud projects add-iam-policy-binding %PROJECT% ^
--member "serviceAccount:%MEMBER%" ^
--role "roles/viewer"

To authorize a service account, you apply the role to the project and not to the service account itself. IAM policies applied to the service account manage who can use the service account and not the service account permissions. Remember to apply permissions for a service account to the project.

To quote Google:

In addition to being an identity, a service account is a resource which has IAM policies attached to it. These policies determine who can use the service account.

For instance, Alice can have the editor role on a service account and Bob can have viewer role on a service account. This is just like granting roles for any other GCP resource.

Now that we have created and authorized this service account, create and download a service account credentials file to be used later in our software.

gcloud iam service-accounts keys create %FILE% --iam-account %MEMBER%

Command output:

created key [db0123456789abcdefghijkl2253e56012345678] of type [json] as [test100.json] for []

To download a P12 format add the command line option:


gcloud iam service-accounts create

gcloud projects add-iam-policy-binding

gcloud iam service-accounts keys create