Google Service Account node

Questions
1

I could use some help, I tried connecting to the Google Service account node and I also have the APIs enabled, but it still says Private key validation failed: 400 - {“error”:“invalid_grant”,“error_description”:“Invalid grant: account not found”}.

2

Hey @Marc2, while you wait for a response, here are some things that might help:

Suggested resources

Automatically matched to your question.

Docs:

Forum:

@mohamed3nan, @anon61017519 - you’ve helped with similar issues before, can you take a look?

Automatically suggested by n8n’s community bot. It’s a pilot - please share feedback here.

3

That error is about the account in the token request, not the key. A wrong key returns “Invalid JWT Signature” instead.

Most likely: “Impersonate a User” is on in the Google Service Account credential and the Email under it is not a live Google Workspace mailbox. A personal gmail.com address cannot be impersonated. Turn the toggle off and test again. If the node truly needs impersonation, that address must be a Workspace user and the service account needs domain-wide delegation with matching scopes in the Admin console.

If the toggle is already off, the Service Account Email field points at a service account that was deleted or recreated, so the key is an orphan. Make a fresh JSON key and copy client_email from it into that field.

Is impersonation on, and is that address Workspace or personal Gmail?

4

I’m using my Admin account under impersonate user in the node.

5

That’s why, you cannot impersonate to do it

6

I took out impersonate user and that didn’t work

7
  1. Check File/Resource Permissions:When impersonation is turned off, the uses the service Account’s identity instead of your personal or Admin email. make sure you copy the Service Account Email (looks like xyz@project.iam.gserviceaccount.com`)and share the specific Google Sheet ,Drive Folder, or resource directly with that email address with editor access.
  2. Genrate a Clean JSON Key :If the Service Account was previously recreated or modified, your current credentials might be invalid or orphaned:

•Go to Google Cloud Console > IAM & Admin > Service Accounts.
•Click on your Service Account, go to the Keys tab, and click Add Key > Create new key (JSON).
•Open the downloaded JSON file.

  1. Re-enter Credentials in n8n :

•Create a new Google Service Account Credential in n8n.

•Keep Impersonate a User toggled OFF.

•Copy and paste the exact client_email and private_key directly from your new JSON file.

If this resolves your issue, please mark this response as the Solution ✓ so it can help others in the community facing the same problem!

9

Hi @Marc2 ,

This error usually occurs when Google is not able to find the service account in your n8n credential.

Check Google Cloud Console that the service account still exists or not. Create a fresh JSON key for the same service account. In n8n, enter the client_email from that JSON file as the Service Account Email and paste the complete private_key from the same file.

Make sure the email and private key are coming from the same JSON file. If the service account was deleted and created again, the old key will not work even if the new account has the same name.

After updating the credential, test it again. May be by doing this your issue is resolved.

10

Hi @Marc2 ,

When using “Impersonate a User”, Google returns Invalid grant: account not found if Domain-Wide Delegation isn’t fully configured in Google Workspace.

Check these two things:

  1. Domain-Wide Delegation in Google Workspace Admin:
    Go to Google Workspace Admin Console > Security > Access and data control > API controls > Domain-wide delegation.
    Make sure you added a new API client using the Numeric Client ID of your Service Account (found in GCP, not the email address) and provided the required OAuth scopes.
  2. Account Type & Aliases:
    Make sure the email in the “Impersonate a user” field is the primary email of an active Workspace user (not an email alias, a Google Group, or a @gmail.com address).
11

Hi @Marc2
The Google Calendar node does not accept Service Account credentials. n8n’s compatibility table lists Calendar as OAuth only, so no amount of key, scope or delegation work will make that credential selectable on the node.
To reach Calendar across a Workspace domain with delegation, drive the API through the HTTP Request node instead. Open the Google Service Account credential, turn on “Set up for use in HTTP Request node”, and enter https://www.googleapis.com/auth/calendar in the Scope(s) field that appears, then point an HTTP Request node at the Calendar REST endpoints using that credential.