Step 3 — Grant domain-wide delegation
This authorizes your service account to read device and license data across your domain, using only the specific scopes below.
Open domain-wide delegation
In the Google Admin console, go to Security → Access and data control → API controls → Manage Domain-Wide Delegation.
Add the service account
Click Add new. Paste the Client ID you copied in Step 2.
Enter the OAuth scopes
In the scopes box, paste these three scopes, comma-separated, then click Authorize:
OAuth scopes
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromeos,
https://www.googleapis.com/auth/apps.licensing
https://www.googleapis.com/auth/admin.directory.device.chromeos,
https://www.googleapis.com/auth/apps.licensing
Copy all three scopes exactly. Order doesn't matter.