Set Up Google Play Service Account Credentials for RevenueCat

Overview

RevenueCat and Google Play communicate through a Google Cloud service account. The service account is a non-human identity that RevenueCat uses to validate Google Play purchases on its servers and to receive Real-time Developer Notifications about renewals, cancellations, and other subscription events. Without valid service account credentials, RevenueCat cannot confirm whether a Google Play purchase or subscription is active.

The setup spans three consoles, and the order matters:

  • Google Cloud Console (console.cloud.google.com) - enable the APIs, create the service account, and generate the JSON key.
  • Google Play Console (play.google.com/console) - grant the service account permission to your Play account.
  • RevenueCat Dashboard (app.revenuecat.com) - upload the credentials JSON to your Google Play Store app.
Prerequisites: You need a Google Play Developer account, admin access to a Google Cloud project (any project works; it does not need to be linked to Play Console), and a RevenueCat project with a Google Play Store app already added. See the Google Play codelab for the full integration and Configure the SDK for app-side setup.

Step 1: Enable the Required APIs

Open the Google Cloud Console and use the project picker at the top to select the project that will hold the service account, or create one. Any project works: Google no longer requires linking a Cloud project to your Play developer account.

Go to APIs & Services > Library, search for Google Play Android Developer API, open it, and click Enable. Also enable the Google Play Developer Reporting API, which RevenueCat's setup guide lists alongside it, and the Cloud Pub/Sub API, which real-time developer notifications need.

Keep everything in one project. The APIs, the service account, and later the Pub/Sub topic must live in the same Cloud project. Enabling an API in one project and creating the service account in another is a common reason credentials fail later. If your organization blocks key creation or Pub/Sub publishing, see Google Cloud Setup for RevenueCat.

Step 2: Create a Service Account

Still in the Google Cloud Console, navigate to IAM & Admin > Service Accounts and click Create service account.

  • Give it a descriptive name, for example revenuecat-play-access, so you can recognize it later.
  • On the Grant this service account access to project step, add Pub/Sub Admin (or Pub/Sub Editor) and Monitoring Viewer. These roles are for real-time developer notifications only. The access RevenueCat needs to Google Play data is granted in Google Play Console in Step 4, not in Cloud IAM.
  • Finish creating the account.

After it is created, copy the service account email address. It looks like revenuecat-play-access@your-project-id.iam.gserviceaccount.com. You will paste this exact address into Google Play Console in Step 4.

Step 3: Create and Download a JSON Key

Open the service account you just created, go to its Keys tab, and choose Add key > Create new key. Select JSON as the key type and confirm. The browser downloads a credentials file that looks like this:

json 
{
  "type": "service_account",
  "project_id": "your-project-id",
  "private_key_id": "abcdef0123456789",
  "private_key": "-----BEGIN PRIVATE KEY-----\n...redacted...\n-----END PRIVATE KEY-----\n",
  "client_email": "revenuecat-play-access@your-project-id.iam.gserviceaccount.com",
  "client_id": "1234567890",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/..."
}
Treat this file as a secret. The JSON key grants access to your Play account data. Do not commit it to source control, paste it into chat tools, or bundle it in your app. Store it in a password manager or secrets store. The only place it needs to go is the RevenueCat dashboard upload in Step 5. If a key leaks, delete it from the service account Keys tab and create a new one.

Step 4: Grant the Service Account Access in Google Play Console

Open the Google Play Console and go to Users and permissions (at the account level, not inside a single app). Click Invite new users and paste the service account email address you copied in Step 2.

Under Account permissions, grant the following permissions:

Permission Why RevenueCat needs it
View app information and download bulk reports (read-only) Read app and product metadata
View financial data, orders, and cancellation survey responses Read order and revenue information
Manage orders and subscriptions Validate, acknowledge, and manage subscription state
Manage store presence Create and update products in Google Play from RevenueCat

Save the invitation. The service account now appears as a user on your Play account with the permissions RevenueCat requires.

Account permissions, not app permissions. Grant these at the account level so they apply across your apps. If you scope permissions to a single app only, RevenueCat may fail to validate purchases for other apps on the same account.

Step 5: Upload the JSON to RevenueCat

In the RevenueCat dashboard, open your project, then open your Google Play Store app from the project's apps list. In the app configuration, find the Service Account credentials JSON field and upload the JSON file you downloaded in Step 3. Save the configuration.

RevenueCat reads the credentials and uses them to authenticate with Google Play going forward. You only upload the file once per app, unless you rotate the key.

Match the package name. Make sure the Google Play Store app in RevenueCat is configured with the same Android package name as the app in Play Console. A mismatch here will surface as validation errors even when the credentials are correct.

Step 6: Wait for Propagation and Verify

Google permission changes are not instant. After granting access in Play Console and uploading the JSON, allow up to 36 hours for the permissions to fully propagate before purchase validation works reliably. In practice it is often much faster, but plan for the full window before concluding that something is misconfigured.

To verify the connection once propagation has had time to complete:

  • Make a test or sandbox purchase in your app, or use an existing real purchase.
  • Open the customer in the RevenueCat dashboard and confirm the transaction appears and validates without credential errors.
  • Confirm that subscription events (renewals, cancellations) show up, which indicates Real-time Developer Notifications and validation are flowing. To connect those notifications, follow Steps 9 and 10 of Google Cloud Setup for RevenueCat.

Troubleshooting

Credential or authentication errors. Confirm the Google Play Android Developer API is enabled in the same Cloud project the service account belongs to. A disabled API, or one enabled in a different project, is a common root cause.
Permission denied even though the API is enabled. Recheck Google Play Console > Users and permissions. The service account email must be present with the four account permissions from Step 4: View app information and download bulk reports, View financial data, Manage orders and subscriptions, and Manage store presence.
It still does not work right after setup. Permissions can take up to 36 hours to propagate. If you just finished the steps, wait and try again before changing anything. Repeatedly re-uploading the JSON does not speed this up.
Wrong JSON uploaded. If you created multiple keys or have several projects, verify the uploaded file's client_email matches the service account you granted access to in Play Console, and that project_id is the project where you enabled the APIs. When in doubt, create a fresh JSON key and re-upload it.

For the latest exact wording and screenshots, see the official RevenueCat documentation.

Related Guides