When using

source-google-search-console

(https://docs.airbyte.com/integrations/sources/google-search-console) and the instructions for using a Service Account with domain-wide delegation are setup, there is no way to set the JWT "sub" or subject which would be the actual Workspace user that is delegated to. There is only the ability to add a JSON Service Account key which would have the actual GCP Service Account and an Admin Email which is used to connect to the Workspace APIs and allow the delegation. But not the actual subject that would be connecting to Google Search Console. What is the purpose of the domain-wide delegation if we need to add the Service Account as a valid user to Search Console and it's not able to impersonate a Workspace user with access?

This is a great question that touches on a real limitation in the connector's current implementation. Based on the available knowledge sources, the documentation for

source-google-search-console

does describe domain-wide delegation and instructs users to grant the

https://www.googleapis.com/auth/webmasters.readonly

OAuth scope to the service account [delegation note]. However, the knowledge sources do not provide a clear explanation of the purpose of domain-wide delegation in this specific context, nor do they document a

subject

(JWT

sub

) field in the connector's configuration. This limitation is actually acknowledged in the context of a related connector (source-google-calendar), where it was explicitly noted: > "Google Calendar service accounts may require domain-wide delegation with a

subject

(the user email to impersonate) for accessing user-specific calendars. The current implementation does not include a

subject

field." [Google Calendar PR] The same concern was raised for source-gmail as well [Gmail PR], suggesting this is a known gap across multiple Google connectors. In short: The knowledge sources confirm that the

subject

field for JWT impersonation is not currently implemented in these connectors, but they do not explain the intended purpose of the domain-wide delegation setup as documented for

source-google-search-console

. Your concern — that without a

sub

claim, the service account cannot impersonate a Workspace user and must instead be added directly as a verified user in Search Console — appears to be a valid gap in the current implementation, but I cannot provide a more definitive answer beyond what the knowledge sources state. I'd recommend raising this as a GitHub issue on the Airbyte repository to get a definitive response from the connector maintainers. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.