Configure authentication to Google Search Console

Beta

This feature is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage Databricks previews.

This page shows how to configure Google Search Console to enable authentication from Databricks for the Google Search Console connector. Use the credentials retrieved from the steps on this page to create a Unity Catalog connection in Databricks.

Prerequisites

To use the Google Search Console connector, you must have:

• A Google account with ownership or full permission on one or more Google Search Console properties (site URLs).
• Access to the Google Cloud Console to create a project, enable the Google Search Console API, and set up credentials.

Configure Google Search Console

The Google Search Console connector supports two authentication methods: OAuth 2.0 user-to-machine (U2M) and OAuth 2.0 machine-to-machine (M2M) using a service account. Follow the steps for your chosen method.

Enable the Google Search Console API

Enable the software as a service (SaaS) Google Search Console API before setting up credentials.

1. Go to the Google Cloud Console and sign in.
2. Select or create a Google Cloud project.
3. In the left sidebar, click APIs & Services > Library.
4. Search for Google Search Console API and click it.
5. Click Enable.

Option 1: OAuth U2M (Recommended)

Use this option to authenticate as a specific Google user via an interactive sign-in flow. The connection uses your own Google identity and has access to all Google Search Console properties that your Google account owns or has full permissions on.

Create an OAuth 2.0 client

1. In the Google Cloud Console, click APIs & Services > Credentials.
2. Click Create Credentials > OAuth client ID.
3. If prompted to configure the OAuth consent screen, click Configure Consent Screen. Select External, fill in the required app name and contact email fields, and click Save and Continue until you reach the Summary page, then click Back to Dashboard.
4. Return to Credentials > Create Credentials > OAuth client ID.
5. For Application type, select Web application.
6. Enter a name for the client.
7. Under Authorized redirect URIs, add the Databricks OAuth redirect URI: https://<your-databricks-workspace-url>/login/oauth/http.html. Replace <your-databricks-workspace-url> with your Databricks workspace URL (for example, https://dbc-a1b2c3d4-e5f6.cloud.databricks.com).
8. Click Create.
9. Note the Client ID and Client Secret shown in the confirmation dialog. You enter these when creating the connection in Databricks.

Option 2: Service Account (OAuth M2M)

Use this option for server-to-server authentication without interactive user sign-in. Service accounts work well for automated pipelines. A service account accesses Google Search Console in one of two ways:

• Its own identity: the service account authenticates as itself. Grant the service account access to each property. Use this for most cases.
• Domain-wide delegation: the service account impersonates a Google Workspace user, and Google Search Console authorizes against that user's existing access. Use this in Google Workspace environments where properties are owned by individual users.

Choose one. Do not complete both Grant the service account access to your Search Console properties and Configure domain-wide delegation.

Create a service account

1. In the Google Cloud Console, click IAM & Admin > Service Accounts.
2. Click Create Service Account.
3. Enter a name and description for the service account, then click Create and Continue.
4. Skip the optional role-granting steps and click Done.
5. On the Service Accounts page, click the service account you created.
6. On the Keys tab, click Add Key > Create new key.
7. Select JSON and click Create. Your browser downloads the service account key file.
8. Save the JSON key file securely. You enter its contents when creating the connection in Databricks.

Grant the service account access to your Search Console properties

Complete this step only if the service account authenticates as its own identity (that is, you leave User Email to Impersonate empty when creating the connection). If you use domain-wide delegation instead, skip to Configure domain-wide delegation. In that case Google Search Console authorizes against the impersonated user's access, not the service account's, so this step has no effect.

1. Go to Google Search Console and sign in.
2. Select a property (site URL).
3. In the left sidebar, click Settings > Users and permissions.
4. Click Add User.
5. Enter the service account's email address (in the format name@project-id.iam.gserviceaccount.com).
6. Set the permission to Full and click Add.
7. Repeat for each additional property the pipeline ingests.

(Optional) Configure domain-wide delegation

Complete this step instead of granting the service account direct access if you want the service account to impersonate a Google Workspace user that already owns the properties. This requires Google Workspace super admin access. For the full procedure, see Set up domain-wide delegation in the Google documentation.

1. In the Google Cloud Console, on the Service accounts page, click the service account you created, then click Show advanced settings.
2. Under Domain-wide delegation, copy the service account's Client ID.
3. As a Google Workspace super admin, go to the Admin console and navigate to Security > Access and data control > API controls.
4. Click Manage Domain Wide Delegation, then click Add new.
5. In the Client ID field, paste the client ID you copied.
6. In the OAuth scopes field, enter https://www.googleapis.com/auth/webmasters.readonly.
7. Click Authorize.
8. Note the Google Workspace user email to impersonate. Confirm this user owns or has Full permission on the properties the pipeline ingests. You enter this email in the User Email to Impersonate field when creating the connection in Databricks.

Next steps

Create a Google Search Console connection in Databricks. See Create a Google Search Console connection.