Step 2: Create a service account and grant it property access

This is the step that unblocks 90% of users. If you've seen 403 You do not own this site, you're in the right place.

Why a service account (not your login)?

The CLI runs on your machine or a server, unattended. It can't "sign in as you" with a browser. Instead it uses a service account. a robot identity with its own credentials stored in a JSON file (sa.json). The tool presents that file to Google to prove it's allowed to inspect your property.

Step 1. Create a Google Cloud project

1. Go to the Google Cloud Console.
2. At the top, create a new project (or pick an existing one).
3. Note: a project is free for the Inspection API at normal volumes. You don't need to enable billing to follow this guide.

Step 2. Enable the API

1. In the Cloud Console, open APIs & Services → Library.
2. Search for Google Search Console API and click Enable.
3. Forgetting this step causes auth errors later. don't skip it.

Step 3. Create the service account

1. Open IAM & Admin → Service Accounts.
2. Click Create Service Account.
3. Give it a name (e.g. gsc-indexer) and click Create and Continue.
4. Skip the role grant for now; click Done.
5. Click the service account you just created, then the Keys tab.
6. Add Key → Create new key → JSON → Create.
7. A file downloads. that's your sa.json. Keep it secret. Anyone with this file can inspect (and read stats about) your property. Don't commit it to git.

What the key file looks like

The downloaded sa.json is a JSON document. The one field you actually need is client_email — that's the address you'll paste into Search Console in the next step. A real key looks like this (values shortened; never share your actual file):

{
  "type": "service_account",
  "project_id": "your-project-id",
  "private_key_id": "a1b2c3d4e5f6...",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----\n",
  "client_email": "[email protected]",
  "client_id": "123456789012345678901",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/gsc-indexer%40your-project-id.iam.gserviceaccount.com"
}

Copy the client_email value exactly — including the @…iam.gserviceaccount.com suffix. gsc-indexer reads the same file at runtime through -creds, so keep it on disk and out of git.

Step 4. Share the property with the service account

This is the exact fix for the 403 error.

1. Go back to Google Search Console.
2. Open your property → Settings → Users and permissions.
3. Click Add user.
4. In the email field, paste the service account's email. You'll find it in sa.json as the client_email value. it looks like [email protected].
5. Permission: Full (not "Restricted"). This is the critical choice. "Restricted" cannot inspect URLs and will still 403.
6. Click Add.

If you only add the SA as Restricted, or forget this step entirely, you'll get 403 You do not own this site, or the inspected URL is not part of this property. Re-do Step 4 with Full access to fix it.

Step 5. Point the tool at the key

Either pass it on every run:

./gsc-indexer -creds /path/to/sa.json "https://www.toolsura.com/"

Or set it once as an environment variable:

export GSC_CREDENTIALS=/path/to/sa.json
./gsc-indexer "https://www.toolsura.com/"

Did I do it right? (pre-flight checklist)

• Cloud project exists and the Search Console API is enabled
• sa.json downloaded and kept private
• SA email added to the GSC property as Full user
• Property prefix exactly matches the URL you'll inspect (www, https)

If all four are checked, you're ready. Next: install the tool and run your first inspection.

Sources

• Google Search Console
• URL Inspection API documentation
• Google Search APIs overview
• Service account OAuth (Google Identity)
• About service accounts (Google Cloud IAM)
• Verify site ownership
• Property types: URL-prefix vs Domain
• URL Inspection tool help
• Indexing API (JobPosting/BroadcastEvent only)
• Request indexing / inspect a URL