授权
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
对零触摸注册客户 API 的 API 调用需要授权。
要求授权可保护贵组织的数据。要授权对
零触摸注册 API，则需要完成以下任务：
- 创建一个服务账号以调用 API。
- 存储 JSON 密钥文件以授权 API 调用。
- 启用该 API，以便将其提供给服务账号。
- 关联服务账号，以代表贵组织执行 API 调用。
以下说明可帮助您完成这些任务。
第 1 步：创建服务账号
服务账号（有时称为机器人账号）是 Google 账号
代表应用而非用户您的应用会代表
这样用户就不必直接参与其中因为您的应用使用的是
Google API，请使用 Google API 控制台设置访问权限。
创建 API 控制台项目
最好为您的应用创建新的 API 控制台项目和服务账号。这样，日后便可更轻松地管理访问权限、管理资源和解决丢失密钥的问题。首先，请按以下步骤创建
在 Google API 控制台中新建项目：
- 前往 API 控制台。
- 从项目列表中，选择创建项目。
- 输入可描述您的应用和零触摸注册的名称。
- 指定项目 ID 或接受默认值。
- 点击创建。
如需了解详情，请参阅 Google Cloud Platform 文档在控制台中管理项目。
添加新的服务凭据
如需向项目添加新的凭据和服务账号，请在 API 控制台中按照以下步骤操作。
- 打开服务账号页面。如果看到提示，请选择项目。
- 点击 add 创建服务账号，并输入服务账号的名称和说明。您可以使用默认服务账号 ID，也可以选择其他唯一的账号 ID。完成后，点击创建。
- 后面的服务账号权限（可选）部分无需设置。点击继续。
- 在向用户授予访问此服务账号的权限屏幕上，向下滚动到创建密钥部分。点击 add 创建密钥。
- 在随即显示的侧面板中，选择密钥的格式：建议使用 JSON。
- 点击创建。您的新公钥/私钥对随后会生成并下载到您的计算机上；该密钥仅此一份。要了解如何安全地存储密钥，请参阅管理服务账号密钥。
- 点击私钥已保存到您的计算机对话框中的关闭，然后点击完成以返回服务账号表格。
复制服务账号的电子邮件地址，并将其记下。您需要
并在稍后将服务账号与您的组织关联时启用。
第 2 步：存储 JSON 密钥文件
API 控制台会生成新的私钥对，用于对使用您的服务账号进行的 API 调用进行身份验证。私钥包含在 JSON 密钥中
文件。
您应将密钥设为私密，因此请勿将其包含在应用的源代码中。如果密钥文件丢失，您需要生成一对新密钥。
第 3 步：启用 API
您需要先启用该 API，然后您的应用才能使用该 API。启用 API
将其与当前的 API 控制台项目相关联，
监控页面。
如需启用此 API，请在您的 API 控制台中执行以下步骤：
- 点击 API 和服务 >
库。
- 使用搜索字段查找 Android 设备配置合作伙伴 API。
- 点击 Android Device Provisioning Partner API。
- 点击启用。
短暂延迟后，API 状态将更改为已启用。如果您没有看到 Android Device Provisioning Partner API，请检查您的组织是否已加入零触摸注册。请确保您在零触摸注册和 Google API 控制台中使用的是相同的 Google 账号。
第 4 步：关联服务账号
将服务账号与贵组织的零触摸注册账号相关联后，该服务账号便有权代表贵组织发出 API 调用。填写关联申请表单，关联您的服务账号。
如果您找不到自己创建的服务账号的电子邮件地址，请从以下任一位置复制该地址：
- Google API 控制台中服务账号页面中的服务账号电子邮件地址。
- JSON 密钥文件中的
client_email 属性字段。
收到账号关联的确认电子邮件后，您的服务
这样就可以代表您的组织调用客户 API 了。
试用 API
按照
快速入门指南
Java、
.NET 和
Python。
授权范围
使用 API 授权范围
在应用的 https://www.googleapis.com/auth/androidworkzerotouchemm 中请求
OAuth 2.0 访问令牌
范围参数用于控制访问权限
令牌允许调用 。访问令牌仅对一组操作有效
令牌请求范围内描述的资源。该 API 涵盖了上述单个零触摸注册范围内的所有方法和资源。
如需详细了解如何使用 Google API 范围，请参阅使用 OAuth 2.0 访问 Google API。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-25。
[null,null,["最后更新时间 (UTC)：2025-07-25。"],[[["\u003cp\u003eAPI calls to the zero-touch enrollment customer API require authorization to protect your organization's data.\u003c/p\u003e\n"],["\u003cp\u003eTo authorize API calls, you must create a service account within the Google API Console, which represents the app, rather than a direct user.\u003c/p\u003e\n"],["\u003cp\u003eA JSON key file generated from the service account creation must be stored securely as it contains the private key used to authenticate API calls.\u003c/p\u003e\n"],["\u003cp\u003eYou need to enable the Android Device Provisioning Partner API within your Google API Console project to make it accessible to the service account.\u003c/p\u003e\n"],["\u003cp\u003eThe service account needs to be linked to your organization's zero-touch enrollment account via a request form to authorize API calls on behalf of your organization.\u003c/p\u003e\n"]]],["To authorize API calls to the zero-touch enrollment customer API, you must: 1) Create a service account via the Google API Console, including generating and downloading a JSON key file. 2) Securely store the downloaded JSON key file. 3) Enable the \"Android Device Provisioning Partner API\" in the API Console. 4) Link the service account to your organization using a request form. Once linked, the service account can make API calls. Use the `https://www.googleapis.com/auth/androidworkzerotouchemm` scope for access.\n"],null,["API calls to the zero-touch enrollment customer API need authorization.\nRequiring authorization protects your organization's data. To authorize calls to\nthe zero-touch enrollment API, you need to complete the following tasks:\n\n1. [Create a service account](#create-service) to call the APIs.\n2. [Store the JSON key file](#store-key) to authorize the API calls.\n3. [Enable the API](#enable-api) to make it available to the service account.\n4. [Link the service account](#link-account) to make API calls on behalf of your organization.\n\nUse the instructions below to help you complete the tasks.\n\nStep 1: create a service account\n\nA service account, sometimes called a robot account, is a Google Account\nrepresenting applications instead of users. Your app calls APIs on behalf of the\nservice account, so users aren't directly involved. Because your app is using\nGoogle APIs, use the Google API Console to set up access.\n\nCreate an API Console project\n\nIt's good practice to create a new API Console project and service\naccount for your app. This makes managing access, managing resources, and fixing\nlost keys easier in the future. Start by following the steps below to create a\nnew project in Google API Console:\n\n1. Go to the [API Console](https://console.cloud.google.com/).\n2. From the projects list, select **[Create a project](https://console.cloud.google.com/projectcreate)**.\n3. Enter a name that describes your app and zero-touch enrollment.\n4. Specify a project ID or accept the default.\n5. Click **Create**.\n\nTo find out more, read the Google Cloud Platform document [Manage projects in\nthe console](https://support.google.com/cloud/answer/6158853).\n\nAdd new service credentials\n\nTo add new credentials and a service account to your project, follow the steps\nbelow in your API Console.\n\n1. Open the [**Service accounts** page](https://console.cloud.google.com/iam-admin/serviceaccounts). If prompted, select a project.\n2. Click add **Create Service Account** , enter a name and description for the service account. You can use the default service account ID, or choose a different, unique one. When done click **Create**.\n3. The **Service account permissions (optional)** section that follows is not required. Click **Continue**.\n4. On the **Grant users access to this service account** screen, scroll down to the **Create key** section. Click add **Create key**.\n5. In the side panel that appears, select the format for your key: **JSON** is recommended.\n6. Click **Create** . Your new public/private key pair is generated and downloaded to your machine; it serves as the only copy of this key. For information on how to store it securely, see [Managing service account keys](https://cloud.google.com/iam/docs/understanding-service-accounts#managing_service_account_keys).\n7. Click **Close** on the **Private key saved to your computer** dialog, then click **Done** to return to the table of your service accounts.\n\nCopy the email address of the service account and keep it handy. You need it\nlater when you link the service account to your organization.\n\nStep 2: store the JSON key file\n\nAPI Console generates a new private key pair used to authenticate\nAPI calls made using your service account. The private key is in the JSON key\nfile you download.\n\nYou should keep the key private, so don't include it in your app's source code.\nIf you lose the key file, you need to generate a new pair of keys.\n| **Warning:** Service account keys can become a security risk if not managed carefully. For advice see [best practices for managing API keys](https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys).\n\nStep 3: enable the API\n\nBefore your app can use the API, you need to enable it. Enabling an API\nassociates it with the current API Console project and adds\nmonitoring pages in your console.\n\nTo enable the API, follow the steps below in your API Console:\n\n1. Click **APIs \\& Services \\\u003e\n [Library](https://console.cloud.google.com/apis/library)**.\n2. Use the search field to find the [*Android Device Provisioning Partner\n API*](https://console.cloud.google.com/apis/library?q=Android%20Device%20Provisioning%20Partner%20API).\n3. Click *Android Device Provisioning Partner API*.\n4. Click **Enable**.\n\nAfter a short delay, the API status changes to enabled. If you don't see\n*Android Device Provisioning Partner API*, check your organization is onboarded\ninto zero-touch enrollment. Make sure you're using the same Google Account for\nzero-touch enrollment and Google API Console.\n\nStep 4: link the service account\n\nLinking the service account with your organization's zero-touch enrollment\naccount authorizes the service account to make API calls on behalf of your\norganization. Fill out the link [request form](https://docs.google.com/forms/d/e/1FAIpQLSePl6v3uL4eylDvf7j8FG4IdYPYn_Qqgmv_HiDMwkwVX-47rw/viewform?usp=sf_link) to link your\nservice account.\n\nIf you can't find the email address of the service account you created, copy it\nfrom one of the following places:\n\n- The **Service account email** from [**Service accounts** page](https://console.cloud.google.com/iam-admin/serviceaccounts) in the Google API Console.\n- The `client_email` property field in the JSON key file.\n\nOnce you receive email confirmation that your account is linked, your service\naccount can then make calls to the customer API on behalf of your organization.\n\nTry out the API\n\nTest that your API access is working by following the steps in one of the\nquickstart guides for\n[Java](/zero-touch/guides/customer/quickstart/java-service-account),\n[.NET](/zero-touch/guides/customer/quickstart/dotnet-service-account), and\n[Python](/zero-touch/guides/customer/quickstart/python-service-account).\n\nAuthorization scopes\n\nUse the API authorization scope\n`https://www.googleapis.com/auth/androidworkzerotouchemm` in your app to request\nan OAuth 2.0 access token.\n\nA scope parameter controls the set of resources and operations that an access\ntoken permits calls to. Access tokens are valid only for the set of operations\nand resources described in the scope of the token request. The API covers all\nthe methods and resources with the single zero-touch enrollment scope shown\nabove.\n\nTo learn more about using Google API scopes, read\n[Using OAuth 2.0 to Access Google APIs](/identity/protocols/OAuth2)."]]
