How to Create a Google Drive Service Account for Migrations

Google Drive doesn't have static API keys. Instead, Univaultport authenticates via a service account — a robot identity you create in Google Cloud and grant access to specific Drive folders. This guide walks you through the full setup and explains the Shared Drive requirement that catches most teams by surprise.

Step 1 — Create or open a Google Cloud project

Sign in to console.cloud.google.com.

If you don't already have a project for this work, click the project picker at the top, then New Project. Name it something like acme-asset-migration. Personal Gmail accounts can create GCP projects too — no Workspace required for reads.

Step 2 — Enable the Google Drive API

In the search bar, type "Google Drive API" and click the matching result. Press Enable. This takes a few seconds.

APIs & Services → Library → "Google Drive API" → Enable

Step 3 — Create the service account

Go to IAM & Admin → Service Accounts → Create Service Account.

1. 1

   Name

   asset-migrator-drive is fine. The auto-generated email will be asset-migrator-drive@<project-id>.iam.gserviceaccount.com.
2. 2

   Description

   Optional. Add something like "Used by Univaultport for Drive migrations" so future-you remembers.
3. 3

   Roles

   Skip — service accounts do NOT need project-level IAM roles for Drive access. Drive permissions are granted by sharing folders directly with the service account email.
4. 4

   Grant users access

   Skip this step too — click Done.

Step 4 — Generate a JSON key

Click into your new service account. Open the Keys tab → Add Key → Create new key → JSON → Create.

Your browser downloads a file like acme-asset-migration-abc123.json. Open it in a text editor — you'll paste the entire contents into Univaultport.

Step 5 — Share the Drive folder(s) with the service account

Copy the service account email from the key file (look for "client_email"). It looks like:

asset-migrator-drive@acme-asset-migration.iam.gserviceaccount.com

In Google Drive (web), navigate to the folder you want to migrate from or to, click Share, and add that email:

• For source folders (read-only migration) → grant Viewer access.
• For destination folders (write migration) → grant Editor access and the folder must live inside a Shared Drive (see warning above).

Step 6 — Get the Folder ID (and Shared Drive ID, if writing)

Open the folder in Drive. The URL looks like:

https://drive.google.com/drive/folders/1aBcDeFgHiJkLmNoPqRsTuVwXyZ
                                        └────────── Folder ID ──────┘

For destination folders inside a Shared Drive, you also need the Shared Drive ID. Open the Shared Drive's home view:

https://drive.google.com/drive/folders/0AHzDz9xYzAbCdEfG
                                        └─ Shared Drive ID ─┘

Step 7 — Paste credentials into Univaultport

In the connector wizard:

1. 1

   Service Account JSON

   Paste the entire contents of the JSON key file. Including the {} braces.
2. 2

   Root Folder ID

   Optional. The folder to scope this connector to. Leave blank to access everything the service account can see.
3. 3

   Shared Drive ID

   Required only when this connector will be used as a destination and the target folder lives in a Shared Drive.

Click Save & test. A green check means Drive responded successfully.

The "Service accounts do not have storage quota" error

This is the single most common Drive migration failure, and it always means the same thing: you tried to upload into a regular My Drive folder.

Fix: create a Shared Drive (Drive sidebar → Shared drives → New), move your destination folder inside it, add the service account email as a Content Manager, and set the Shared Drive ID in the connector.

For Workspace accounts, Shared Drives are free. For personal Gmail accounts, Shared Drives require a Google Workspace plan — there's no workaround.

Reads from any Drive work — even personal Gmail

The quota limitation only affects writes. If you're migrating from Drive to (e.g.) S3 or Cloudinary, a personal Gmail account works perfectly. Just share the source folder with the service account email as Viewer.

Troubleshooting

Next steps

With reads working, you can migrate from Drive to any destination. With Shared Drive writes configured, Drive becomes a fully bidirectional connector. The destination folder picker in Univaultport's migration wizard will list every folder your service account can see.