初始设置
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
开发者设置
为云项目启用 API 套件
- 前往 Cloud 控制台：https://console.cloud.google.com/。
- 选择现有云项目或创建新项目。
- 转到
APIs & Services > Enable APIs and Services。
- 搜索“Chrome”。
- 选择“Chrome Management API”。
- 熟悉服务条款。
- 点击
Enable。
创建凭据
替代方案 1：OAuth 2.0 客户端 ID
- 您需要先使用应用的相关信息配置 OAuth 权限请求页面，然后才能创建“OAuth 2.0 客户端 ID”。
在 Cloud 控制台中，前往
APIs & Services > OAuth consent screen。
在同意屏幕配置页面中，输入范围：
- 对于 Reports API，添加：
https://www.googleapis.com/auth/chrome.management.reports.readonly
- 对于 App Details API，请添加：
https://www.googleapis.com/auth/chrome.management.appdetails.readonly
- 对于 Telemetry API，请添加：
https://www.googleapis.com/auth/chrome.management.telemetry.readonly
请注意，添加的范围属于敏感信息，因此您可能需要提交您的应用供验证。否则，如果您的应用不是内部应用，用户可能会看到安全警告屏幕。
请前往 APIs & Services > Credentials > Create Credentials > OAuth client ID 并按照相应步骤创建凭据。
（可选）在 OAuth Playground 中测试您的应用（请参阅操作方法）。
替代方案 2：服务账号
- 转到
APIs & Services > Credentials > Create Credentials > Service account。
- 输入服务账号名称，然后点击
Create。
- 为您的服务帐号创建密钥。点击
Add Key 并创建“json”密钥。请将该文件保存在安全的位置。
- 使用您的服务帐号为客户设置适当的管理员权限：
- 客户可以设置全网域授权，然后服务帐号就可以模拟拥有适当权限的用户/管理员（了解方法）
- 或者，客户可以直接向服务帐号授予对服务帐号的适当权限的管理员角色（了解方法）。
为客户设置
根据开发者创建的应用类型，客户管理员有不同的设置选项。
“OAuth 2.0 客户端”应用
无需特殊设置。
应用用户需要适当的管理员权限（请参阅具体方法）。
应用用户需要同意应用 OAuth 弹出式同意屏幕。您也可允许此应用使用全网域授权功能（请参阅具体方法），这样就无需向用户显示 OAuth 弹出式同意屏幕。
（可选）验证应用是否未被屏蔽，或是否明确信任该应用（查看具体方法）。
“服务帐号”应用
必须为服务帐号授予适当的管理员权限。
您可以通过以下两种方法之一执行此操作：
- 允许全网域授权，以便服务帐号可以模拟拥有适当权限的管理员（请参阅方法）。
- 直接为服务帐号授予管理员角色（了解方法）。
“操作方法”指南
如何屏蔽或信任应用
- 以客户管理员的身份，前往管理控制台 (https://admin.google.com/)。
- 导航到
Security > Access and data control > API controls。
- 在
App access control 部分，点击 Manage third party app access。
- 如果您没有在“关联的应用”列表中看到该应用，则可以配置一个新应用。
- 您现在可以屏蔽该应用，或者明确信任该应用。
如何启用全网域授权功能
- 以客户管理员的身份，前往管理控制台 (https://admin.google.com/)。
- 导航到
Security > Access and data control > API controls > Domain-wide delegation。
- 点击
Add new。
- 输入客户端 ID（“服务账号唯一 ID”或“应用客户端 ID”）。
- 输入所有必要的 OAuth 范围。根据具体应用，您可能不仅需要为 Chrome Management API 输入范围，例如用于管理设备、用户、浏览器、组织部门、群组的 Directory API，
- 点击
Authorize。
如何管理管理员权限
Chrome Management API 的不同部分需要不同的管理员权限。查看 Reports API、App Details API 或 Telemetry API 需要哪些管理员权限。
如需授予权限，请执行以下操作：
- 以客户管理员的身份，前往管理控制台 (https://admin.google.com/)。
- 前往
Admin roles 页面。
- 查找现有角色或创建具有必要权限的新角色。
- 将此角色分配给用户电子邮件地址或服务帐号电子邮件地址。
如何在 OAuth Playground 中测试您的应用
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-25。
[null,null,["最后更新时间 (UTC)：2025-07-25。"],[[["\u003cp\u003eDevelopers need to enable the Chrome Management API, create credentials (OAuth or Service Account), and understand setup options for customer admins.\u003c/p\u003e\n"],["\u003cp\u003eCustomer admins need to configure settings based on the developer's application type, potentially granting privileges or enabling domain-wide delegation.\u003c/p\u003e\n"],["\u003cp\u003e"How to" guides provide detailed instructions for blocking/trusting apps, enabling domain-wide delegation, managing admin privileges, and testing in OAuth Playground.\u003c/p\u003e\n"],["\u003cp\u003eDifferent Chrome Management APIs require specific admin privileges, and detailed information is available in their respective guides.\u003c/p\u003e\n"],["\u003cp\u003eOAuth 2.0 Client apps need user consent or Domain-Wide Delegation, while Service Account apps require explicit admin privilege grants.\u003c/p\u003e\n"]]],[],null,["# Initial Setup\n\nSetup for a developer\n---------------------\n\n### Enable API suite for cloud project\n\n- Navigate to Cloud Console: \u003chttps://console.cloud.google.com/\u003e.\n- Select existing cloud project or create a new one.\n- Go to `APIs & Services \u003e Enable APIs and Services`.\n- Search for \"Chrome\".\n- Select \"Chrome Management API\".\n- Familiarize yourself with Terms of Service.\n- Click `Enable`.\n\n### Create Credentials\n\n#### Alternative 1: OAuth 2.0 Client IDs\n\n- Before you are able to create \"OAuth 2.0 Client ID\" you need to first configure the OAuth consent screen with information about your application. In Cloud Console, go to `APIs & Services \u003e OAuth consent screen`.\n- In your consent screen config page, enter the scopes:\n\n - For Reports API add: `https://www.googleapis.com/auth/chrome.management.reports.readonly`\n - For App Details API add: `https://www.googleapis.com/auth/chrome.management.appdetails.readonly`\n - For Telemetry API add: `https://www.googleapis.com/auth/chrome.management.telemetry.readonly`\n\n Note that added scopes are sensitive, so you may need to submit your app for verification. Otherwise, users may see a security warning screen if your app is not internal.\n- Go to `APIs & Services \u003e Credentials \u003e Create Credentials \u003e OAuth client ID` and follow the steps to create the credentials.\n\n- Optionally, test your app in OAuth Playground (see [How to](#how_to_test_your_app_in_oauth_playground)).\n\n#### Alternative 2: Service Account\n\n- Go to `APIs & Services \u003e Credentials \u003e Create Credentials \u003e Service account`.\n- Enter service account name and click `Create`.\n- Create a key for your service account. Click `Add Key` and create \"json\" key. Keep track of the file in a secure location.\n- Use your service account with proper admin privileges for customer:\n - Customer may set up Domain-Wide Delegation and then the service account can impersonate a user/admin who has proper privileges (see [how](#how_to_enable_domain-wide_delegation))\n - or customer may grant an admin role with proper privileges to the service account directly (see [how](#how_to_manage_admin_privileges)).\n\nSetup for a customer\n--------------------\n\nDepending on which application type the developer created, the customer admin has different setup options.\n\n#### \"OAuth 2.0 Client\" Apps\n\nNo special setup is needed.\n\nApp users require proper admin privileges (see [how](#how_to_manage_admin_privileges)).\n\nApp users need to agree to the app OAuth pop-up consent screen.\nOptionally, you can allow this app to use Domain-Wide Delegation (see [how](#how_to_enable_domain-wide_delegation)), which will omit the OAuth pop-up consent screen for users.\n\nOptionally verify if the app isn't blocked, or trust the app explicitly (see [how](#how_to_block_or_trust_an_app)).\n\n#### \"Service Account\" Apps\n\nThe service account must be granted proper admin privileges.\nYou can do this in either of two ways:\n\n- Allow Domain-Wide Delegation so the Service Account can impersonate an admin that has proper privileges (see [how](#how_to_enable_domain-wide_delegation)).\n- Grant Admin Roles for the service account directly (see [how](#how_to_manage_admin_privileges)).\n\n\"How to\" guides\n---------------\n\n### How to block or trust an app\n\n- As customer admin, go to Admin Console (https://admin.google.com/).\n- Navigate to `Security \u003e Access and data control \u003e API controls`.\n- In the `App access control` section, click `Manage third party app access`.\n- If you don't see the app in the 'Connected apps' list, you can configure a new app.\n- You can now block the app or trust the app explicitly.\n\n### How to enable domain-wide delegation\n\n- As customer admin, go to Admin Console (https://admin.google.com/).\n- Navigate to `Security \u003e Access and data control \u003e API controls \u003e Domain-wide delegation`.\n- Click `Add new`.\n- Enter client ID (\"service account unique id\" or \"app client ID\").\n- Enter all necessary OAuth scopes. Depending on the app, you may need to enter scopes for more than just Chrome Management API; e.g. the Directory API for managing devices, users, browsers, OUs, groups, etc.\n- Click `Authorize`.\n\n### How to manage admin privileges\n\nFor different portions of the Chrome Management APIs, different admin privileges\nare needed. See which admin privileges are required for\n[Reports API](/chrome/management/guides/reports_api),\n[App Details API](/chrome/management/guides/app_details_api), or\n[Telemetry API](/chrome/management/guides/telemetry_api).\n\nTo grant privileges:\n\n- As customer admin, go to Admin Console (https://admin.google.com/).\n- Navigate to `Admin roles` page.\n- Find an existing role or create a new role with the necessary privileges.\n- Assign this role to the user email address or the service account email address.\n\n### How to test your app in OAuth Playground\n\n- In Cloud Console, when creating an OAuth client ID for your app (see above [OAuth 2.0 Client IDs](/chrome/management/guides/setup#alternative_1_oauth_20_client_ids) section) select application type \"Web Applications\".\n- Enter a 'Name'.\n- To test your app, add `https://developers.google.com/oauthplayground` to the \"Authorized redirect URIs\" field. You can remove the redirect URI from your app when you're done testing.\n- Click `Create` and copy \"client ID\" and \"client secret\".\n- Go to [OAuth Playground](https://developers.google.com/oauthplayground/)\n- Click the gear icon in the top right corner ('OAuth 2.0 Configuration'), select `Use your own OAuth credentials`, and enter \"OAuth Client ID\" and \"OAuth Client secret\".\n- Follow these steps in OAuth Playground\n\n - Select \\& authorize APIs.\n\n Add `https://www.googleapis.com/auth/chrome.management.reports.readonly` (or other api scope) in the scope input field and click 'Authorize APIs'.\n Authorize using a customer admin account. Agree to the terms.\n - Exchange authorization code for tokens.\n\n Click `Exchange authorization code for tokens`. Optionally, click `Auto-refresh the token before it expires`.\n - Configure request to API.\n\n Enter your API URL in the 'Request URI' text box. Modify 'HTTP Method', 'Enter request body', etc. as per the API specification.\n For example, use the following URL to count the installed Apps in your organization: `https://chromemanagement.googleapis.com/v1alpha1/customers/my_customer/reports:countInstalledApps`"]]
