4

My company owns several (verified) facilities and using my company's email i can see those locations (business.google.com). enter image description here

Now, my company would like to fetch the reviews in each location and present it in our company website. Before we're using the Google Place API but since it only returns the latest 5 reviews we opt to using Google My Business API to retrieve a location's complete reviews. We'd like our backend (PHP) to retrieve the reviews so using the same email I created a service account (console.developers.google.com/apis/credentials) because we don't need the end user to allow/interact anything when browsing our website. enter image description here

Using postman (with my signed JWT) I have managed to get a valid access token enter image description here

...that I use to retrieve the lists of accounts (mybusinessaccountmanagement.googleapis.com/v1/accounts) I could see the service account itself alone in the response.enter image description here

Now, I tried calling the account locations api (mybusiness.googleapis.com/v4/accounts/{MY_ACCOUNT_ID_HERE}/locations) but it only returns and empty object response.

enter image description here

Can someone help me resolve this issue. Why my service account can't see the verified locations under my company's email. Is this even possible? Thank you.

user1828473
  • 61
  • 1
  • 4

1 Answers1

3

Even that this is an older question - I run into the same issue calling the new Google My Business Information v1 API (getting empty results) using a service account.

It seems, that it is not recommended to use Service Accounts, I found this support article on Google: https://support.google.com/business/thread/8281160/cannot-get-access-to-gmb-locations-with-service-account-with-nodejs?hl=en

The "official" recommendation is to use OAuth.

But we finally made it using Service Account. The following steps are necessary to resolve it (at least for us it is working now):

  • Add a project in Google Cloud Platform
  • Add and enable the Account Management and Business Information API's.
  • Add the service account and generate a key (https://developers.google.com/identity/protocols/oauth2/service-account#creatinganaccount)
  • Make the Business Profile API request (you need the approval made by Google to be able to make requests against the two API's; otherwise you may run into quota exceeds as "Request per minute" is set to 0 by default). Important: It may take up to 2 weeks until, but we received the approval within about 5 days
  • Enable domain-wide delegation for the service account using the scope "https://www.googleapis.com/auth/business.manage". More about domain-wide-delegation: https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority)
  • Add a user identity in GCP. This user also needs to be added in Google My Business for editing locations. When creating your ServiceAccountCredential object, impersonate this user.

Security concerns:

  • Domain-wide-delegation enables that everyone knowing/having the credentials of the service account could impersonate any person (identity) from withing GCP. At least in this case only for Business Profile API, but anyway, keep this in mind.
  • Also using private keys for authenticating the service account is not recommended, you should be aware to regularly change / create a new private key or there would be a solution with Identity Workload.

Hope this helps everyone facing the challenge with GMB / GCP / service accounts :-)

Christoph Bachmann
  • 51
  • 5
  • 2
    Just if someone still is interested: we just got this statement of Google support: "Unfortunately, we don't officially support service accounts in the Google My Business API, if you are having issues we recommend you OAuth directly into the Google Account that manages the business listings you are trying to access rather than using a service account to impersonate the account." – Christoph Bachmann Apr 29 '22 at 10:54
  • thanks for the update, we face the same issue. Just out of curiosity, did you use OAuth in the end or some other method? – gybandi Jun 13 '22 at 13:24
  • 1
    Sorry for the late response... As mentioned in the answer, we have used the service account (following the described steps it works). – Christoph Bachmann May 08 '23 at 10:46
  • Do you have to sign-up and pay for google workspaces to enable domain-wide-delegation? – user158443 Jul 21 '23 at 08:06