Documentation Plugins Google Sheets data source Setup Configure

Configure the Google Sheets data source plugin

Before configuring the the Google Sheets data source plugin, you must:

• Install the plugin
• Add a new data source

Authentication

The Google Sheets data source supports the following three ways of authentication:

• Google JWT File: uses a service account and can access private spreadsheets. Works in all environments where Grafana is running.
• API key: offers simpler configuration, but requires spreadsheets to be public.
• GCE Default Service Account automatically retrieves default credentials. Requires Grafana to be running on a Google Compute Engine virtual machine.

Depending on your authentication type, you may need to configure appropriate permissions on your spreadsheets, refer to the sharing section for more guidance.

Authenticate with a service account JWT

If you want to access private spreadsheets, you must use a service account authentication. A Google service account belongs to a project within an account or organization instead of to an individual end user. The application, in this case Grafana, calls Google APIs on behalf of the service account, so users aren’t directly involved.

The project that the service account is associated with needs to be granted access to the Google Sheets API and the Google Drive API.

The Google Sheets data source uses the scope https://www.googleapis.com/auth/spreadsheets.readonly to get read-only access to spreadsheets. It also uses the scope https://www.googleapis.com/auth/drive.metadata.readonly to list all spreadsheets that the service account has access to in Google Drive.

To create a service account, generate a Google JWT file and enable the APIs:

1. Before you can use the Google APIs, you need to enable them in your Google Cloud project.
   1. Open the Google Sheets API page and click enable.
   2. Open the Google Drive API page and click enable.
2. Open the Credentials page in the Google API Console.
3. Click Create Credentials then Service account.
4. Fill out the service account details form and then click Create and continue.
5. Ignore the Service account permissions and Principals with access sections, just click Done.
6. Click into the details for the service account, navigate to the Keys tab, and click Add Key. Choose key type JSON and click Create. A JSON key file will be created and downloaded to your computer.
7. Upload or drag this file into the JWT Key Details section of the data source configuration.
8. Grant the service account access to resources as appropriate.

Authenticate with an API key

If a spreadsheet is shared publicly on the internet the request doesn’t need to be authorized, but does need to be accompanied by an identifier - which is the API key.

To generate an API key:

1. Before you can use the Google APIs, you need to enable them in your Google Cloud project.
   1. Open the Google Sheets API page and click enable.
2. Open the Credentials page in the Google API Console.
3. Click Create Credentials and then API key.
4. Paste the value in the API Key field of the data source configuration.

Authenticate with the default GCE service account

When Grafana is running on a Google Compute Engine (GCE) virtual machine, Grafana can automatically retrieve default credentials from the metadata server. As a result, there is no need to generate a private key file for the service account. You also don’t need to upload the file to Grafana.

To authenticate with the default GCE service account:

1. You must create a service account for use by the GCE virtual machine. For more information, refer to Create new service account.
2. Verify that the GCE virtual machine instance is running as the service account that you created. For more information, refer to setting up an instance to run as a service account.
3. Allow access to the specified API scope.
4. Enter the project name in the Default project field of the data source configuration

Sharing

Refer to the following official guidance from Google to learn how to share resources from:

• Google Sheets
• Google Drive

Granting access to the service account used with JWT authentication

By default, the service account doesn’t have access to any spreadsheets within the account or organization that it’s associated with. To grant the service account access to files and or folders in Google Drive, you need to share the file or folder with the service account’s email address. The service account’s email address is the client_email field in the JWT file.