Google Workspace

The scanner authenticates as a service account with domain-wide delegation, impersonating an admin. One-time setup:

In the Google Cloud console, create (or pick) a project and enable the Admin SDK API.
Create a service account (no roles needed). On the service account’s Keys tab, choose Add key → Create new key → JSON — a .json key file downloads to your machine. The scanner authenticates with this file.
Copy the service account’s Client ID from its details page.
In the Google Admin console, go to Security → Access and data control → API controls → Domain-wide delegation → Add new. Paste the Client ID and authorize exactly these scopes:
```
https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.user.security
```
Install the downloaded key:
Terminal window
```
assetloom-app-scanner config google
```
It validates the key file and copies it to ~/.assetloom-scanner/google.json, so scans can omit --key.

Both scopes are read-only.