Gemini for Workspace

Create a service account and JSON key

1. In the Google Cloud Console , select (or create) the project you’ll use.
2. Go to APIs & Services > Library, search for Admin SDK API, and click Enable.
3. Go to IAM & Admin > Service Accounts and create a service account (e.g., antenna-reports). No project IAM roles are required for this integration.
4. Open the service account, go to the Keys tab, and select Add key > Create new key > JSON. A .json key file downloads to your computer — keep it secret. You’ll paste its contents into Antenna later.
5. On the service account’s Details tab, note its Unique ID (a ~21-digit Client ID). You’ll need it in the next step.

Authorize the Admin SDK scopes

Grant the service account domain-wide delegation for the three read-only scopes.

1. In the Google Admin console , go to Security > Access and data control > API controls > Domain-wide delegation.
2. Click Add new.
3. Enter the service account’s Client ID from the previous step.
4. In OAuth scopes, enter all three scopes as a comma-separated list:

https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://www.googleapis.com/auth/admin.reports.audit.readonly,
https://www.googleapis.com/auth/admin.directory.user.readonly

5. Click Authorize.

Grant the impersonated admin the Reports privilege

The Admin SDK only returns data when acting as a Workspace admin. Choose the account the service account will impersonate and confirm it has the Reports and Users > Read privileges.

• The simplest option is to use an existing Super Admin account, which already includes these privileges.
• For least privilege, create a custom admin role in Account > Admin roles with the Reports privilege (under Admin console privileges) and the Users > Read privilege (under Admin API privileges), then assign it to the account under Directory > Users > (user) > Admin roles and privileges.

Connect in Antenna

1. Navigate to Settings > Sources > Add source in your app.antenna.dev  account.
2. Click Connect next to Gemini for Workspace.
3. Enter the Workspace Admin Email — the admin account the service account impersonates (from the previous step).
4. Paste the full Service Account JSON Key you downloaded.
5. (Optional) Enter your Customer ID (found in the Admin console under Account > Account settings). Leave blank to default to the impersonated admin’s own account.
6. (Optional) Enter an Average Cost Per Seat to estimate spend (see below).
7. Click Connect to complete the setup.