Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Configurare l'API Devices
Questa pagina spiega come configurare l'API Cloud Identity Devices. Puoi utilizzare l'API Devices per eseguire il provisioning delle risorse in modo programmatico, ad esempio per gestire Google Gruppi, per conto di un amministratore.
Abilitare l'API e configurare le credenziali
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Configurare l'accesso all'API utilizzando un account di servizio con delega a livello di dominio
Questa sezione descrive come creare e utilizzare un service account
per accedere alle risorse Google Workspace. L'autenticazione diretta all'API
Devices utilizzando unaccount di serviziot non è supportata, quindi
devi utilizzare questo metodo.
Crea un account di servizio e configuralo per la delega a livello di dominio
Per creare un account di servizio e scaricare la relativa chiave:
Per creare un service account:
Nella console Google Cloud , vai alla pagina degli account di servizio IAM:
In Dettagli service account, digita un nome, un ID e una descrizione per il account di servizio, quindi fai clic su Crea e continua.
(Facoltativo) In Concedi a questo account di servizio l'accesso al progetto, seleziona
i ruoli IAM da concedere al account di servizio.
Fai clic su Continua.
(Facoltativo) In Concedi agli utenti l'accesso a questo service account, aggiungi gli utenti o i gruppi autorizzati a utilizzare e gestire il account di servizio.
Per creare e scaricare una chiave dell'account di servizio:
Fai clic sull'indirizzo email del account di servizio che hai creato.
Fai clic sulla scheda Chiavi.
Nell'elenco a discesa Aggiungi chiave, seleziona Crea nuova chiave.
Fai clic su Crea.
Viene generato e scaricato sul tuo computer un file delle credenziali in formato JSON contenente una nuova coppia di chiavi pubblica e privata. Il file contiene l'unica copia delle chiavi. Sei responsabile della sua archiviazione in sicurezza. Se perdi la coppia di chiavi,
devi generarne una nuova.
Esamina le voci di log
Quando esamini le voci di log, tieni presente che i log di controllo mostreranno le azioni dell'account di servizio come se fossero state avviate dall'utente. Questo perché la delega a livello di dominio
consente all'account di servizio di simulare l'identità di un utente
amministratore.
Inizializzare le credenziali
Quando inizializzi la credenziale nel codice, specifica l'indirizzo email su cui agisce il account di servizio chiamando with_subject() sulla credenziale.
Ad esempio:
SERVICE_ACCOUNT_CREDENTIAL_FILE: il file della chiave del account di servizio che hai creato in precedenza in questo documento
USER: l'utente rappresentato dal account di servizio
Ora puoi iniziare a effettuare chiamate all'API Devices.
Per eseguire l'autenticazione come utente finale, sostituisci l'oggetto credential dell'account di servizio con l'oggetto credential che puoi ottenere in Ottenere token OAuth 2.0.
Installare la libreria client Python
Per installare la libreria client Python, esegui questo comando:
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eThe Cloud Identity Devices API is set up using a service account with domain-wide delegation, as direct authentication via a service account is not supported.\u003c/p\u003e\n"],["\u003cp\u003eSetting up involves creating a service account, configuring domain-wide delegation to allow the service account to access the Devices API, and creating a downloadable service account key.\u003c/p\u003e\n"],["\u003cp\u003eService account keys pose a security risk if not handled correctly, requiring careful management and secure storage, or alternative authentication methods if possible.\u003c/p\u003e\n"],["\u003cp\u003eAudit logs will display service account actions as being initiated by the user because the service account impersonates an administrator user via domain-wide delegation.\u003c/p\u003e\n"],["\u003cp\u003eCredential initialization in your code requires specifying the email address the service account acts on, and a Python client library can be installed via the \u003ccode\u003epip\u003c/code\u003e command.\u003c/p\u003e\n"]]],[],null,["# Set up the Devices API\n======================\n\nThis page explains how to set up the Cloud Identity Devices API. You can use the\nDevices API to programmatically provision resources---for example\nmanaging Google Groups---on behalf of an administrator.\n\nEnable the API and setting up credentials\n-----------------------------------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Cloud Identity API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=cloudidentity.googleapis.com)\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Cloud Identity API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=cloudidentity.googleapis.com)\n\nSet up API access using a service account with domain-wide delegation\n---------------------------------------------------------------------\n\nThis section describes how to create and use a [service account](/iam/docs/service-accounts)\nto access Google Workspace resources. Authenticating directly to the\nDevices API using a service account isn't supported, so you\nmust use this method.\n\n### Create a service account and configure it for domain-wide delegation\n\nTo create a service account a download the service account key, do the\nfollowing:\n\n1. To create a service account, do the following:\n\n 1. In the Google Cloud console go to the IAM service accounts\n page:\n\n [Go to service accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)\n 2. Click add **Create service account**.\n\n 3. Under **Service account details** , type a name, ID, and description for the\n service account, then click **Create and continue**.\n\n 4. Optional: Under **Grant this service account access to project**, select\n the IAM roles to grant to the service account.\n\n 5. Click **Continue**.\n\n 6. Optional: Under **Grant users access to this service account**, add the\n users or groups that are allowed to use and manage the service account.\n\n 7. Click **Done**.\n\n2. To let the service account access Devices API by using\n domain-wide delegation, follow the instructions in [Set up domain-wide delegation for the service account](https://support.google.com/a/answer/162106).\n\n3. To create and download a service account key, do the following.\n\n | **Important:** Service account keys are a security risk if not managed correctly. You should [choose a more secure alternative to service account keys](/docs/authentication#auth-decision-tree) whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys). If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see [Managing secure-by-default organization resources](/resource-manager/docs/secure-by-default-organizations).\n |\n |\n | If you acquired the service account key from an external source, you must validate it before use.\n | For more information, see [Security requirements for externally sourced credentials](/docs/authentication/external/externally-sourced-credentials).\n 1. Click the email address for the service account you created.\n 2. Click the **Keys** tab.\n 3. In the **Add key** drop-down list, select **Create new key**.\n 4. Click **Create**.\n\n A JSON-formatted credential file, containing a new public and private key pair,\n is generated and downloaded to your machine. The file contains the only copy of\n the keys. You are responsible for storing it securely. If you lose the key pair,\n you must generate a new one.\n\n### Review log entries\n\nWhen reviewing log entries, note that audit logs will show any service account\nactions as having been initiated by the user. This is because domain-wide\ndelegation works by allowing the service account to impersonate an administrator\nuser.\n\n### Initialize credentials\n\nWhen you initialize the credential in your code, specify the email address on\nwhich the service account acts by calling `with_subject()` on the credential.\nFor example: \n\n### Python\n\n credentials = service_account.Credentials.from_service_account_file(\n '\u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_CREDENTIAL_FILE\u003c/var\u003e',\n scopes=SCOPES).with_subject(\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eUSER\u003c/span\u003e\u003c/var\u003e\n )\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_CREDENTIAL_FILE\u003c/var\u003e: the service account key file that you created earlier in this document\n- \u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e: the user that the service account impersonates\n\n#### Instantiating a client\n\nThe following example shows how to instantiate a client using service account\ncredentials. \n\n### Python\n\n from google.oauth2 import service_account\n import googleapiclient.discovery\n\n SCOPES = ['https://www.googleapis.com/auth/cloud-identity.devices']\n\n def create_service():\n credentials = service_account.Credentials.from_service_account_file(\n '\u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_CREDENTIAL_FILE\u003c/var\u003e',\n scopes=SCOPES\n )\n\n delegated_credentials = credentials.with_subject('\u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e')\n\n service_name = 'cloudidentity'\n api_version = 'v1'\n service = googleapiclient.discovery.build(\n service_name,\n api_version,\n credentials=delegated_credentials)\n\n return service\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_CREDENTIAL_FILE\u003c/var\u003e: the service account key file that you created earlier in this document\n- \u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e: the user that the service account impersonates\n\nYou can now begin making calls to the Devices API.\n\nTo instead authenticate as an end-user, replace the `credential` object from the\nservice account with the `credential` you can obtain in [Obtaining OAuth 2.0 tokens](https://developers.google.com/identity/protocols/oauth2/web-server#obtainingaccesstokens).\n\nInstalling the Python client library\n------------------------------------\n\nTo install the Python client library, run the following command: \n\n pip install --upgrade google-api-python-client google-auth \\\n google-auth-oauthlib google-auth-httplib2\n\nFor more on setting up your Python development environment, refer to the\n[Python Development Environment Setup Guide](/python/docs/setup)."]]
