Client data sheets under your own Google account
Connect a Google service account and shared drive once, so every client's data sheet is created, owned and read under your agency's name rather than the platform's.
Some clients keep spend, deals or offline revenue somewhere no connection can reach. For them the platform creates one Google Sheet per client and reads it once a day - what the client sees and fills in is covered in Manual Uploads. This page is about whose Google account those sheets live under, which is a decision you make once for the whole agency, under Connections - Integrations - Client data sheets.
Why connect your own account
Leave the section empty and the sheets are created by the platform's own service account, on the platform's shared drive. That works, but two things are wrong with it for a white-label agency:
- The sheet a client opens names an owner that is not you. Google shows the owning account in the share dialog and under Shared with me, and it will be an address on the platform's domain.
- You cannot reach your own clients' files. They sit on a drive you are not a member of, so getting at one means going through the platform's support.
Add your own service account and every sheet from then on is created by, owned by and read under your agency's identity, on a drive you control.
Do this before the first sheet exists
Sheets are read with whichever account is configured at the time of the read, not the one that created them. A sheet created under the platform's account lives on the platform's drive, which your service account is not a member of, so switching accounts after the fact stops that sheet being read. If any client already has a sheet, ask support before saving the form - the file has to be moved across first, and only its owner can do that.
What you need
About fifteen minutes, done once. You need admin access to your Google Workspace and to Google Cloud, and you need to be an admin on the platform (the Integrations page is admin-only).
Step 1 - a shared drive
Create a shared drive in Google Drive, for example "Client data sheets". A shared drive rather than a folder, because membership of a shared drive is a real security boundary and a folder is not.
Three settings decide whether your clients can open their sheets at all. Your clients are outside your organisation, so without them a sheet is created and nobody can open it.
- Workspace admin console, Apps - Google Workspace - Drive and Docs - Sharing settings: Sharing outside of your organisation must be on.
- Same panel: Viewers and commenters can download, print and copy stays on. That is what lets a departing client take a copy of their own data.
- The shared drive's own settings: People outside your organisation can access files in this shared drive ticked.
The drive ID is the last part of the drive's address in your browser - everything after /drive/folders/ (or /drive/u/0/folders/). You will paste it into the form in step 5.
Step 2 - a Google Cloud project with two APIs on
In the Google Cloud console, create a new project - do not reuse one that holds a reporting OAuth client. Under APIs & Services - Library, enable both the Google Sheets API and the Google Drive API. Drive is what creates and shares the file; Sheets alone is not enough.
Step 3 - a service account and its key
Under IAM & Admin - Service Accounts, create a service account. Three things to get right:
- Skip the "grant this service account access to project" step. It needs no project roles. Its access comes from being a member of your shared drive, nothing else.
- Do not enable domain-wide delegation. It would let the account act as any user on your domain, and the shared drive makes it unnecessary.
- Under Keys, add a new key, choose JSON, and keep the download. It holds two values the form needs:
client_emailandprivate_key.
The service account's email address (it ends in .iam.gserviceaccount.com) is not a secret. The JSON file and the private key inside it are - do not send them over chat or email.
Key creation is blocked by an organisation policy
Google's Secure by Default enforcement switches on a policy called iam.disableServiceAccountKeyCreation across new organisations. If Add key is greyed out or refused, an administrator has to set that policy to Not enforced on this one project. Two things that look like they worked and did not:
- The Organisation Policy Administrator role must be granted on the organisation, chosen in the console's resource picker. Granting it on the project appears to save and does nothing. The Organisation Administrator role does not include it.
- There are two policies with the same display name. The one that enforces is the legacy
iam.disableServiceAccountKeyCreation; theiam.managed.one is usually already inactive.
Override it on the project only, so the organisation-wide default still stands everywhere else.
Step 4 - add the service account to the shared drive
Open the shared drive, choose Manage members, paste the service account's email address and give it Content manager. No notification is sent and there is nothing to accept - a service account has no inbox.
If creating a client's sheet later fails when the platform tries to share it with the client, raise the service account to Manager.
Step 5 - fill in the form
On Connections - Integrations, under Client data sheets:
| Field | What to paste |
|---|---|
| Service account email | The client_email value from the JSON file |
| Private key | The whole private_key value, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines |
| Shared drive ID | The last part of the drive's address, from step 1 |
| Template spreadsheet ID | Leave blank - see the next section |
The key is write-only: it is stored encrypted and never shown again. After saving, the field reads A key is stored. Leaving it blank on a later save keeps the stored key; pasting a new one replaces it, which is how you rotate a key without re-entering anything else.
The badge beside the form switches from Using the platform's to Your account once all three of the email, the key and the drive ID are stored.
The three fields are needed together
What a partial save does depends on which part is missing, and the form warns you before you save:
- Saved without the email or the drive ID: nothing changes. Sheets carry on under the platform's account until both are present.
- Saved with the email and the drive ID but no key: the platform switches to your account and has nothing to sign in with, so creating or reading a sheet fails until the key is added. Paste the
private_keyand save again.
There is no template to build
Each client's sheet is built from scratch when you press Set up: the tabs, the locked columns, the date rules and the dropdowns are all laid down by the platform, under your service account, on your shared drive. Earlier sheets were copies of a master template that had to be built for your workspace first; that step is gone, and the Template spreadsheet ID field can stay empty.
Do not rename the tabs or the column headings on a client's sheet: they are what the platform reads by. Colours, column widths and extra formatting are safe to change.
After it is set up
Open a client's dashboard, go to Setup, then Manual Uploads, and create their sheet. The file is named "Client name - Marketing data", lands on your shared drive, and arrives with a Start here page and the Leads, Sales, Costs, Ad Spend and Lists tabs already laid out. Every person on that client's login list is given edit access, and that access follows the list: add or remove a user and their access to the sheet follows.
The sheet is read once a day (early morning, UTC). To read it straight away, press Refresh now on the client's dashboard - it reads the sheet after their connected accounts - or Check for new rows, which reads the sheet alone. What the rows mean, what the Status column says and how a typed figure is kept from being counted twice are all in Manual Uploads.
Who can see the data
Membership of your shared drive is the access control. Everything on it - revenue, deal names, named customers - is visible to every member, so keep that list short and treat "who is a member of the client data drive" as something you review rather than something that grows.
Never share a sheet as anyone with the link can edit. A link survives a forwarded email indefinitely; the platform grants access per person for exactly that reason.
If something looks wrong
A client cannot open their sheet
Why: one of the three sharing settings in step 1 is off. The sheet was created and shared, but Google refuses to let an outside address open it.
Fix: check all three - outside sharing on in the Workspace admin console, and outside access ticked on the shared drive itself. The grant is already there; it starts working as soon as the setting is on.
Creating a client's sheet fails with a permissions error
Why: the service account can see the drive but is not allowed to share files outward from it.
Fix: in the shared drive's members list, raise the service account from Content manager to Manager, then press Set up again.
I saved the form and sheets stopped working
Why: the email and the drive ID were saved without the key. The platform is now using your account and cannot sign in as it.
Fix: paste the private_key from the JSON file - the whole value, BEGIN and END lines included - and save again.
The key is refused, or reads fail with a signing error
Why: the pasted key is not the complete value. The commonest cause is a quotation mark copied along with it from the JSON file - a single leading quote is enough, and the error names the signing library rather than the quote.
Fix: paste the value again from -----BEGIN PRIVATE KEY----- to -----END PRIVATE KEY----- with nothing either side. Line breaks written as \n are fine; the platform accepts either form.
A sheet that worked last month is no longer read
Why: the account doing the reading changed. If you added your own service account after that sheet was created, the sheet is still on the platform's drive, which your account cannot see.
Fix: ask support to move the sheet onto your drive. Sharing it with your service account is not enough - the locked columns can only be written by the file's owner. New sheets are unaffected.
For the rest - rows not counted, dates read as the wrong month, a tab that stopped counting - see Manual Uploads, which covers what the client sees.
Last updated 2 October 2026