We recommend that you use a service account for authentication when you
integrate with the Google Spectrum Access System (SAS) Portal API.

## Set up a service account

To use a service account for authentication, complete the following steps:

1. [Create a service account](https://docs.cloud.google.com/iam/docs/creating-managing-service-accounts#creating_a_service_account).
2. [Create your service account key](https://docs.cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys)
   and select **JSON** as your key type.

   After you complete this step, your service account key is downloaded to your browser's default location.
3. [Grant the **Project Owner** role](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt) to the service account.

## Obtain a bearer token

You need to provide your service account authentication as a bearer token. If
you call the SAS Portal API directly, such as by making an HTTP
request with `curl`, you pass your authentication as a bearer token in the
`Authorization` header.

To obtain a bearer token with your service account, follow these steps:

1. [Install the Google Cloud CLI](https://docs.cloud.google.com/sdk/install).

2. In the gcloud CLI, authenticate to your service account:

   ```
     gcloud auth activate-service-account --key-file ${KEY_FILE}
   ```

   Replace `${KEY_FILE}` with the path to your service account key file.
3. Use your service account to obtain an authorization token:

   ```
     gcloud auth print-access-token
   ```

   The command returns an access token value.
4. When you use the API, pass the token value as a bearer token in an
   `Authorization` header. The following code sample shows how to pass the token
   value as a bearer token:

   ```
   curl -X GET -H "X-Goog-User-Project: ${CLIENT_PROJECT}" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${TOKEN}" \
    "https://sasportal.googleapis.com/v1alpha1/customers"
   ```

   Replace the following:
   - `${CLIENT_PROJECT}`: the [ID of the Google Cloud project](https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects.md.txt) from which you make the requests
   - `${TOKEN}`: the authorization token

## What's next

- To get an overview of the SAS Portal API, see [Google SAS Portal API overview](https://docs.cloud.google.com/spectrum-access-system/docs/overview-api.md.txt).
- For information about each API, see the [Customers](https://docs.cloud.google.com/spectrum-access-system/docs/customers-api.md.txt) and [Device Manager](https://docs.cloud.google.com/spectrum-access-system/docs/device-manager-api.md.txt) API pages.
- For examples of how to use the API, see [API code samples](https://docs.cloud.google.com/spectrum-access-system/docs/samples.md.txt).
- For reference documentation, see [APIs and reference](https://docs.cloud.google.com/spectrum-access-system/docs/apis.md.txt).