Before you start: most of this happens in Google, not in Astrato. You’ll need someone who can create things in your organisation’s Google Cloud account, someone who can add members to the shared drive files should land in, and an Astrato administrator. That may all be you. Set aside twenty minutes.
Note: the work spans three separate Google sites, and mixing them up is the usual reason this goes wrong. Google Cloud Console at console.cloud.google.com is where you create the account Astrato will use. Google Drive at drive.google.com is where you give that account access. Google Admin at admin.google.com only comes into it if something blocks you.
Create the account Astrato will use
Astrato doesn’t sign in as you. It uses an account of its own, called a service account, which you create and control. Reports keep arriving when you’re on holiday, and you can cut off access later without changing anyone’s password.
All of this happens in Google Cloud Console.
Open
console.cloud.google.comand create a project, or pick one your organisation already uses for integrations.
The New Project form in Google Cloud Console, with the project name filled in and the project ID shown beneath it
Important: the Project ID shown under the name can’t be changed once the project exists. The name itself can.
Turn on the Drive API for that project.
Go to APIs & Services ▸ Library, search for Google Drive API, and click Enable.
The Google Drive API page in the API Library, with the Enable button
Note: check you’re in the right project first. Enabling it on the wrong one is the most common reason everything looks correct but nothing arrives.
Go to IAM & Admin ▸ Service Accounts and click Create service account.
Give it a name that says what it’s for. Astrato works fine.
The Create service account form, showing the name, the generated account ID, and the resulting email address
You don’t need the optional Permissions or Principals with access steps — those grant access to Google Cloud, not to Drive. Click Create and close.
Copy the account’s email address.
It ends in
.iam.gserviceaccount.com. You’ll need it in the next section.
The service accounts list showing the new Astrato account, marked Enabled with no keys yet
Open the ⋮ menu on that row and choose Manage keys.
The actions menu on a service account row, with Manage keys among the options
Click Add key, then Create new key.
The Add key menu open, offering Create new key or Upload existing key
Leave JSON selected and click Create.
The Create private key dialog with JSON selected and marked Recommended
Result: a .json file downloads to your computer. That file is what you’ll paste into Astrato.
Warning: treat that file like a password. Anyone who has it can act as this account. Google can’t give you the same file twice — if you lose it, create a new key and delete the old one.
If you can’t create a key
Some organisations block service account keys, and Google Cloud organisations created recently block them by default. If Create new key is greyed out or throws an error, that’s what’s happening, and it isn’t something you can fix yourself.
Someone with the Organization Policy Administrator role has to allow it for this one project. Send them this:
We need to create a service account key in project <your project> so Astrato can deliver reports to our shared drive. The policy constraints/iam.managed.disableServiceAccountKeyCreation is blocking it. Could you add an exception for this project? Changes take up to 15 minutes to apply.
You may hit a similar block when creating the project itself. Same kind of restriction, same person to ask.
Give that account access to your drive
Creating the account doesn’t give it access to anything. This is the step people skip, and everything looks fine right up until the first report fails.
This happens in Google Drive, not in Google Cloud.
Important: it has to be a shared drive, not a folder in My Drive. Service accounts get no storage of their own and can’t own files, so a personal folder will always fail. There’s no way around this.
Note: if you don’t have a shared drive and can’t create one, your organisation has restricted who may make them. Ask whoever administers Google at your company to create one, or to point you at an existing drive you can use.
In Google Drive, open the shared drive you want reports to land in, then choose Manage members.
The Manage members dialog for a shared drive, with an empty Add people and groups field
Paste the service account’s email address and set its role to Contributor.
The Manage members dialog with the service account address added and the role list open, showing Contributor selected.
Contributor covers adding files, which is all report delivery needs. Pick Content manager instead if you want Astrato to be able to replace or delete files it created earlier.
Important: sharing the drive with everyone at your company doesn’t include the service account. Its address isn’t part of your domain, so you have to add it here by name.
Note: once the service account is a member, Google may mark the drive as shared outside your organisation. That’s expected — a service account’s address isn’t part of your domain. Worth mentioning to your security team before they notice it themselves.
If you can’t add it at all: your organisation restricts sharing outside your domain, and a service account’s address sits outside it. Ask whoever administers Google at your company — the setting is under Google Admin ▸ Apps ▸ Google Workspace ▸ Drive and Docs ▸ Sharing settings.
Copy the drive’s ID from the address bar.
It’s the part after
/drive/folders/, and it starts with0A.
A browser address bar showing a Google Drive URL, with the shared drive ID after /drive/folders/
Result: the service account is a member of the drive, and you have the drive’s ID.
Add the connection in Astrato
You’ll need to be an Astrato administrator for this part.
Open Administration from the left-hand menu.
The Administration item in the Astrato left-hand menu
Find 3rd Party Integrations and click View.
The Administration page showing the 3rd Party Integrations card with a View button
Click Add Integration and choose Google Drive.
The 3rd Party Integrations page with the Add Integration button
Fill in the form.
Name — anything you’ll recognise later, like
Drive — Finance reportsService Account Key (JSON) — the entire contents of the file you downloaded
Shared Drive ID (required) — the
0A…value from the previous stepPath inside drive (optional) — a folder within that drive, written like
Reports/2026
The Add new Google Drive notification integration form, with the name, service account key, shared drive ID and path fields
Click Save Changes.
Result: the connection is ready and will appear as a delivery option wherever reports are sent. Nothing has been delivered yet — choosing what to send and when is the next step.
If reports don’t arrive
The connection saved without complaint, but nothing lands in the drive. Every cause below is something in the setup above.
The file never arrives, and there’s no obvious error
What it means: Astrato accepted your settings but can’t write to the drive.
Likely causes: the service account was never added to the drive, or it was added to a different drive than the one whose ID you pasted.
How to fix it: open the shared drive, choose Manage members, and check the service account’s address is listed. Then check the ID in the address bar matches the one in Astrato.
Delivery fails with a permissions error
What it means: the account is a member of the drive but isn’t allowed to add files.
Likely causes: its role is Viewer or Commenter.
How to fix it: change it to Contributor or Content manager under Manage members.
Delivery fails with a storage or quota error
What it means: Astrato is being pointed somewhere a service account can’t write.
Likely causes: the ID belongs to a folder in someone’s My Drive rather than to a shared drive.
How to fix it: use a shared drive. This isn’t a settings problem and can’t be worked around.
Everything looks right and still nothing happens
What it means: the pieces are each correct but don’t belong together.
Likely causes: the Drive API is switched on for a different project than the one your key came from.
How to fix it: open APIs & Services ▸ Library in the project named inside your JSON file, and check Google Drive API shows as enabled there.