Google Apps Script Service Account impersonation without downloading private service account keys 

Avoid downloading private service account keys by using impersonation in Apps Script to obtain access tokens.

For Google Workspace Admins you can gain super powers (and super responsibility) using Google Cloud project service accounts. A common scenario is using service accounts with domain-wide delegation to make API calls impersonating Google Workspace users. With this you can do things like set a user’s Gmail settings including signatures, authenticate as a user in Google Chat and much more.

A quick way to use a service account is to download a JSON key. The challenge then given the potential capabilities of service accounts is securely storing the JSON key. A alternative approach, which is explained in this post by Justin Poehnelt, is using Apps Script to create and fetch a short-lived credential for your service account.

Short-lived credentials are highly recommended for applications requiring robust security and precise access control for service accounts, reducing the attack surface and the risks with accidentally exposing static secrets.

You can find out more include code snippets/setup in Justin’s post which also links to the support documentation.

Source: Apps Script Service Account Impersonation | Justin Poehnelt