Google Play Credentials

To fill in the Add New App form for Android, you need a Service Account JSON key from your Google Cloud Project. Here's how to create it.

If you already have a Service Account set up from a previous app, skip to Step 5 to add the new app to it.

Step 1: Create or select a Google Cloud Project

1. Go to Google Cloud Console
2. Create a new project or select an existing one

Step 2: Enable the Google Play Developer API

1. In the left column go to APIs & Services → Library
2. Search for Google Play Android Developer API
3. Click Enable API

Step 3: Create a Service Account

1. In the left column go to IAM & Admin → Service Accounts
2. Click + Create Service Account
3. Give it a name (e.g., refundshield-sa)
4. Click Done
5. Copy your Service Account Email, you will need it in step 5

Step 4: Generate a JSON Key

1. In the Service Accounts list click on the account you just created
2. Go to the Keys tab
3. Click Add Key → Create New Key
4. Choose JSON format
5. Download the file and keep it secure

Important: Download the JSON file right away and store it securely. If you lose it, you'll need to generate a new key.

Step 5: Invite the Service Account to your app in Google Play Console

Permissions must be set at the app level, not at the account level.

1. Go to Google Play Console
2. Go to Users and Permissions → Invite new users
3. Enter the Service Account email you created in step 3 (ends with @...gserviceaccount.com).
   You can also find it in the JSON file under "client_email".
4. Under App permissions:
   • Click Add app
   • Select your app
   • Click Apply
5. Then enable these permissions:
   • View app information
   • View financial data
   • Manage orders and subscriptions
6. Click Invite user
7. Click Send invitation

These permissions are necessary for RefundShield to check the validity of your app setup, listen for refund requests, answer via orders.reviewrefund and check the google decision.

You can find the Service Account email in the JSON file under "client_email".

Security

Your Service Account JSON key is encrypted at rest in our database using AES-256 encryption. It is never stored in plain text, never logged, and never exposed in the UI after submission.

Credential Errors

If RefundShield detects invalid Google credentials (HTTP 401/403), you'll receive a notification email. To resolve:

1. Verify the Service Account still exists in GCP
2. Verify the invitation in Play Console is still active (at the app level, not account level)
3. Verify all three permissions are checked: View app information, View financial data, Manage orders
4. Regenerate the JSON key if expired or revoked
5. Upload the new JSON in the app edit page on RefundShield