Google Cloud Platform Service Account — Setup Guide

Overview Use this guide to create and configure a Google Cloud Platform service account in MinuteView Console. This service account uses OAuth authentication with user login to enable system-level access to Google Cloud services for:

• Cloud Storage — Access and manage files in Google Cloud Storage buckets
• AI/ML services — Use Google Cloud AI and Vision APIs from MinuteView workflows
• Workflow automation — Trigger Google Cloud operations from MinuteView Automations

Unlike a third-party Google Cloud account (which is linked to an individual user), a service account operates at the system level with group-based permissions. This means workflows and automations use a shared Google identity rather than a specific user's personal account.

---

Network Requirements

The Google Cloud Platform service account setup involves an OAuth flow where part of the process happens in the user's browser and part happens on the MinuteView server itself. After the user authenticates with Google and is redirected back to MinuteView, the server exchanges the authorization code for a token by calling Google's API directly. This means the MinuteView server must have outbound internet access to the following domains.

Required Firewall / Proxy Whitelist

The following domains must be accessible via HTTPS (port 443) from the server where MinuteView is installed:

Domain	Purpose
oauth2.googleapis.com	OAuth token exchange and token refresh
www.googleapis.com	Retrieving the authenticated user's profile information
storage.googleapis.com	Google Cloud Storage operations (if using Cloud Storage)
vision.googleapis.com	Google Cloud Vision API (if using Vision features)

Server Access Required

These domains must be reachable from the server, not just from the user's PC. The user's browser handles the initial login redirect, but the token exchange and all subsequent API calls are made server-side. If the server cannot reach these domains, the service account setup will fail with a connection error even though the Google login page loaded successfully in the browser.

---

1) Create OAuth Credentials in Google Cloud Console

Create Project (if needed)

1. Sign in to Google Cloud Console at https://console.cloud.google.com/
2. Create a new project or select an existing one

Enable Required APIs

1. Navigate to APIs & Services → Library
2. Enable the APIs you need (e.g. Cloud Storage JSON API, Cloud Vision API)

Configure OAuth Consent Screen

1. Navigate to APIs & Services → OAuth consent screen
2. Configure with your organization details and required scopes

Create OAuth Client

1. Navigate to APIs & Services → Credentials → Create Credentials → OAuth client ID
2. Application type: Web application
3. Name: e.g. MinuteView Service Integration
4. Authorized redirect URIs: You will set this in step 2 below
5. Click Create

Collect Credentials

• Client ID: your-client-id.apps.googleusercontent.com
• Client Secret: (store securely)

---

2) Create Service Account in MinuteView Console

1. Navigate to Console → Service Accounts
2. Click New to create a new service account
3. Configure the following settings:

Configuration Fields

Field	Description	Example
Name	A descriptive name for this service account	GoogleCloud-ServiceAccount-Prod
Service Account Type	Select Google Cloud Platform from the dropdown
Client ID	The OAuth Client ID from Google Cloud Console	123456789.apps.googleusercontent.com
Client Secret	The OAuth Client Secret from Google Cloud Console	(sensitive — stored securely)
Callback URL	The MinuteView OAuth redirect URI	https://your-server/MinuteView/PageGeneral/ServiceCallback.aspx

4. Before saving: Copy the Callback URL and add it as an authorized redirect URI in Google Cloud Console for your OAuth client
5. Click Save and Login to save the configuration and begin the OAuth flow

OAuth Authentication Flow

6. You will be redirected to the Google login page
7. Sign in with the Google account whose permissions the service should operate under
8. Grant MinuteView access to the requested Google Cloud scopes
9. You will be redirected back to MinuteView — the service account will show Connected status

---

3) Token Management

MinuteView automatically manages OAuth tokens for this service account:

• Access Token: Used for API calls (expires in 1 hour)
• Refresh Token: Used to obtain new access tokens (long-lived)
• Automatic Refresh: MinuteView refreshes tokens before expiration

---

4) Troubleshooting

"Failed to retrieve authentication token" / Connection error

• The most common cause is that the MinuteView server does not have outbound internet access to Google's APIs. See Network Requirements above for the domains that must be whitelisted.

Redirect URI Mismatch

• Verify the callback URL in Google Cloud Console exactly matches the URL shown in MinuteView Console
• Check for trailing slashes or protocol differences (http vs https)

Invalid Client Credentials

• Double-check the Client ID and Client Secret from Google Cloud Console
• Verify the OAuth client is properly configured

Insufficient Scope / Access Denied

• Verify the required APIs are enabled in Google Cloud Console
• Check the authenticated user has appropriate permissions in the Google Cloud project

Token Refresh Failures

• Re-authenticate by clicking the Login button again
• Verify the authenticated user's Google account is still active
• Check the OAuth consent has not been revoked