Add automatic GCP service account provisioning for GAM integration #509
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Instead of partners sending service account credentials, we now create service accounts in our GCP project and provide partners with just the email address to add to their GAM. Partner workflow: 1. Request service account in Admin UI 2. We create SA in our GCP project → provide email 3. Partner adds email to their GAM with appropriate permissions 4. Partner tests connection Security model: - Two-factor control: private key (we control) + GAM user list (partner controls) - Both required for access; partner can revoke anytime Implementation: - New GCPServiceAccountService class using Google Cloud IAM API - Encrypted storage of service account keys (Fernet) - Database migration adds gam_service_account_email field - Two new API endpoints: /create-service-account, /get-service-account-email - UI section with create button, email display, setup instructions - Proper cleanup of temporary credentials files (security fix) Configuration: - GCP_PROJECT_ID environment variable (set in fly.toml) - Management service account with IAM permissions - Credentials via GOOGLE_APPLICATION_CREDENTIALS_JSON Fly secret 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
EmmaLouise2018
pushed a commit
that referenced
this pull request
Oct 24, 2025
) Instead of partners sending service account credentials, we now create service accounts in our GCP project and provide partners with just the email address to add to their GAM. Partner workflow: 1. Request service account in Admin UI 2. We create SA in our GCP project → provide email 3. Partner adds email to their GAM with appropriate permissions 4. Partner tests connection Security model: - Two-factor control: private key (we control) + GAM user list (partner controls) - Both required for access; partner can revoke anytime Implementation: - New GCPServiceAccountService class using Google Cloud IAM API - Encrypted storage of service account keys (Fernet) - Database migration adds gam_service_account_email field - Two new API endpoints: /create-service-account, /get-service-account-email - UI section with create button, email display, setup instructions - Proper cleanup of temporary credentials files (security fix) Configuration: - GCP_PROJECT_ID environment variable (set in fly.toml) - Management service account with IAM permissions - Credentials via GOOGLE_APPLICATION_CREDENTIALS_JSON Fly secret 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
danf-newton
pushed a commit
to Newton-Research-Inc/salesagent
that referenced
this pull request
Nov 24, 2025
…dcontextprotocol#509) Instead of partners sending service account credentials, we now create service accounts in our GCP project and provide partners with just the email address to add to their GAM. Partner workflow: 1. Request service account in Admin UI 2. We create SA in our GCP project → provide email 3. Partner adds email to their GAM with appropriate permissions 4. Partner tests connection Security model: - Two-factor control: private key (we control) + GAM user list (partner controls) - Both required for access; partner can revoke anytime Implementation: - New GCPServiceAccountService class using Google Cloud IAM API - Encrypted storage of service account keys (Fernet) - Database migration adds gam_service_account_email field - Two new API endpoints: /create-service-account, /get-service-account-email - UI section with create button, email display, setup instructions - Proper cleanup of temporary credentials files (security fix) Configuration: - GCP_PROJECT_ID environment variable (set in fly.toml) - Management service account with IAM permissions - Credentials via GOOGLE_APPLICATION_CREDENTIALS_JSON Fly secret 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Implements automatic service account provisioning for Google Ad Manager integration. Instead of partners sending us their service account credentials, we now create service accounts in our GCP project and provide partners with just the email address to add to their GAM.
Partner Workflow:
Security Model:
Two-factor control ensures both parties maintain control:
Both are required for access. Partner can revoke anytime by removing the email from GAM.
Implementation Details
Backend:
GCPServiceAccountServiceclass for managing service account lifecycle/create-service-accountand/get-service-account-emailgam_service_account_emailfield to track provisioned accountsFrontend:
Configuration:
GCP_PROJECT_IDenvironment variable (set to "bok-playground" in fly.toml)GOOGLE_APPLICATION_CREDENTIALS_JSONFly secretSecurity:
Testing
adcp-manager@bok-playground.iam.gserviceaccount.comDocumentation
docs/gam-service-account-setup.mdwith security model explanationdocs/gcp-service-account-provisioning-setup.mdwith deployment guide.env.examplewith GCP configurationFiles Changed
pyproject.toml: Addedgoogle-cloud-iam>=2.19.1dependencyalembic/versions/661c474053fa_*.py: Migration for service account email fieldsrc/core/database/models.py: Addedgam_service_account_emailfield with documentationsrc/services/gcp_service_account_service.py: New service class (350+ lines)src/admin/blueprints/gam.py: Two new API endpointstemplates/tenant_settings.html: Service account integration UI sectionstatic/js/tenant_settings.js: JavaScript handlers for SA creationfly.toml: AddedGCP_PROJECT_IDenvironment variable.env.example: Documented GCP configuration.gitignore: Added service account key patternsdocs/*.md: Updated documentation🤖 Generated with Claude Code
Co-Authored-By: Claude noreply@anthropic.com