Play service account

A Play service account is a Google Cloud identity, with a downloaded JSON key, that has been granted permissions inside Play Console so it can call the Play Developer API on your behalf.

It exists in two places at once, and that is the whole reason people get stuck. In the Google Cloud console you create the service account and generate a JSON key, which gives you an email address like releases@my-project.iam.gserviceaccount.com and a file containing a private key. In Play Console you invite that email address under Users and permissions and grant it the permissions it needs, then link the Cloud project under API access.

A service account with a valid key and no Play Console invitation authenticates perfectly and can do nothing. The error you get talks about permissions or an unknown application, which sends people back to regenerate the key. The key was never the problem.

Grant narrowly. Release to testing tracks is a different permission from Release to production, and separate credentials for CI and for a production promotion step is a reasonable habit. App-level rather than account-level access is available if you publish several apps.

Newly granted permissions do not always take effect immediately, and delays of hours are commonly reported.

The JSON file is a credential with publishing rights. Keep it out of the repo.

See also: Play Developer API, Play Console, Play edit.