Penyiapan Awal
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Penyiapan untuk developer
Aktifkan API suite untuk project cloud
Buat Kredensial
Alternatif 1: Client ID OAuth 2.0
- Sebelum dapat membuat "Client ID OAuth 2.0", Anda harus terlebih dahulu mengonfigurasi layar izin OAuth dengan informasi tentang aplikasi Anda.
Di Cloud Console, buka
APIs & Services > OAuth consent screen.
Di halaman konfigurasi layar izin, masukkan cakupan:
- Untuk Reports API, tambahkan:
https://www.googleapis.com/auth/chrome.management.reports.readonly
- Untuk API Detail Aplikasi, tambahkan:
https://www.googleapis.com/auth/chrome.management.appdetails.readonly
- Untuk Telemetry API, tambahkan:
https://www.googleapis.com/auth/chrome.management.telemetry.readonly
Perlu diperhatikan bahwa cakupan yang ditambahkan bersifat sensitif, sehingga Anda mungkin perlu mengirimkan aplikasi untuk diverifikasi. Jika tidak, pengguna mungkin akan melihat layar peringatan keamanan jika aplikasi Anda tidak bersifat internal.
Buka APIs & Services > Credentials > Create Credentials > OAuth client ID, lalu ikuti langkah-langkah untuk membuat kredensial.
Jika ingin, Anda dapat menguji aplikasi di OAuth Playground (lihat Cara).
Alternatif 2: Akun Layanan
- Buka
APIs & Services > Credentials > Create Credentials > Service account
- Masukkan nama akun layanan, lalu klik
Create.
- Buat kunci untuk akun layanan Anda. Klik
Add Key dan buat kunci “json”. Lacak file di lokasi yang aman.
- Gunakan akun layanan Anda dengan hak istimewa admin yang sesuai untuk pelanggan:
- Pelanggan dapat menyiapkan Delegasi Tingkat Domain, lalu akun layanan dapat meniru identitas pengguna/admin yang memiliki hak istimewa yang sesuai (lihat cara)
- atau pelanggan dapat langsung memberikan peran admin dengan hak istimewa yang sesuai ke akun layanan (lihat caranya).
Penyiapan untuk pelanggan
Bergantung pada jenis aplikasi yang dibuat developer, admin pelanggan memiliki opsi penyiapan yang berbeda.
Aplikasi "Klien OAuth 2.0"
Tidak perlu pengaturan khusus.
Pengguna aplikasi memerlukan hak istimewa admin yang tepat (lihat caranya).
Pengguna aplikasi harus menyetujui layar izin pop-up OAuth aplikasi.
Secara opsional, Anda dapat mengizinkan aplikasi ini menggunakan Delegasi Tingkat Domain (lihat caranya), yang akan menghilangkan layar izin pop-up OAuth untuk pengguna.
Secara opsional, verifikasi apakah aplikasi tidak diblokir, atau percayai aplikasi secara eksplisit (lihat caranya).
Aplikasi "Akun Layanan"
Akun layanan harus diberi hak istimewa admin yang sesuai.
Anda dapat melakukannya dengan salah satu dari dua cara berikut:
- Izinkan Delegasi Tingkat Domain sehingga Akun Layanan dapat meniru identitas admin yang memiliki hak istimewa yang sesuai (lihat caranya).
- Memberikan Peran Admin untuk akun layanan secara langsung (lihat caranya).
Panduan "cara kerja"
Cara memblokir atau memercayai aplikasi
- Sebagai admin pelanggan, buka Konsol Admin (https://admin.google.com/).
- Buka
Security > Access and data control > API controls
- Di bagian
App access control, klik Manage third party app access.
- Jika tidak melihat aplikasi di daftar 'Aplikasi terhubung', Anda dapat mengonfigurasi aplikasi baru.
- Anda kini dapat memblokir aplikasi atau memercayai aplikasi secara eksplisit.
Cara mengaktifkan delegasi tingkat domain
- Sebagai admin pelanggan, buka Konsol Admin (https://admin.google.com/).
- Buka
Security > Access and data control > API controls > Domain-wide delegation
- Klik
Add new.
- Masukkan client ID ("ID unik akun layanan" atau "ID klien aplikasi").
- Masukkan semua cakupan OAuth yang diperlukan. Bergantung pada aplikasinya, Anda mungkin perlu memasukkan cakupan untuk lebih dari sekadar Chrome Management API; misalnya, Directory API untuk mengelola perangkat, pengguna, browser, OU, grup, dll.
- Klik
Authorize.
Cara mengelola hak istimewa admin
Untuk berbagai bagian Chrome Management API, diperlukan hak istimewa admin yang berbeda. Lihat hak istimewa admin yang diperlukan untuk
Reports API,
App Details API, atau
Telemetry API.
Untuk memberikan hak istimewa:
- Sebagai admin pelanggan, buka Konsol Admin (https://admin.google.com/).
- Buka halaman
Admin roles.
- Temukan peran yang ada atau buat peran baru dengan hak istimewa yang diperlukan.
- Tetapkan peran ini ke alamat email pengguna atau alamat email akun layanan.
Cara menguji aplikasi di OAuth Playground
Kecuali dinyatakan lain, konten di halaman ini dilisensikan berdasarkan Lisensi Creative Commons Attribution 4.0, sedangkan contoh kode dilisensikan berdasarkan Lisensi Apache 2.0. Untuk mengetahui informasi selengkapnya, lihat Kebijakan Situs Google Developers. Java adalah merek dagang terdaftar dari Oracle dan/atau afiliasinya.
Terakhir diperbarui pada 2025-07-25 UTC.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Informasi yang saya butuhkan tidak ada","missingTheInformationINeed","thumb-down"],["Terlalu rumit/langkahnya terlalu banyak","tooComplicatedTooManySteps","thumb-down"],["Sudah usang","outOfDate","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Masalah kode / contoh","samplesCodeIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-25 UTC."],[[["\u003cp\u003eDevelopers need to enable the Chrome Management API, create credentials (OAuth or Service Account), and understand setup options for customer admins.\u003c/p\u003e\n"],["\u003cp\u003eCustomer admins need to configure settings based on the developer's application type, potentially granting privileges or enabling domain-wide delegation.\u003c/p\u003e\n"],["\u003cp\u003e"How to" guides provide detailed instructions for blocking/trusting apps, enabling domain-wide delegation, managing admin privileges, and testing in OAuth Playground.\u003c/p\u003e\n"],["\u003cp\u003eDifferent Chrome Management APIs require specific admin privileges, and detailed information is available in their respective guides.\u003c/p\u003e\n"],["\u003cp\u003eOAuth 2.0 Client apps need user consent or Domain-Wide Delegation, while Service Account apps require explicit admin privilege grants.\u003c/p\u003e\n"]]],[],null,["Setup for a developer\n\nEnable API suite for cloud project\n\n- Navigate to Cloud Console: \u003chttps://console.cloud.google.com/\u003e.\n- Select existing cloud project or create a new one.\n- Go to `APIs & Services \u003e Enable APIs and Services`.\n- Search for \"Chrome\".\n- Select \"Chrome Management API\".\n- Familiarize yourself with Terms of Service.\n- Click `Enable`.\n\nCreate Credentials\n\nAlternative 1: OAuth 2.0 Client IDs\n\n- Before you are able to create \"OAuth 2.0 Client ID\" you need to first configure the OAuth consent screen with information about your application. In Cloud Console, go to `APIs & Services \u003e OAuth consent screen`.\n- In your consent screen config page, enter the scopes:\n\n - For Reports API add: `https://www.googleapis.com/auth/chrome.management.reports.readonly`\n - For App Details API add: `https://www.googleapis.com/auth/chrome.management.appdetails.readonly`\n - For Telemetry API add: `https://www.googleapis.com/auth/chrome.management.telemetry.readonly`\n\n Note that added scopes are sensitive, so you may need to submit your app for verification. Otherwise, users may see a security warning screen if your app is not internal.\n- Go to `APIs & Services \u003e Credentials \u003e Create Credentials \u003e OAuth client ID` and follow the steps to create the credentials.\n\n- Optionally, test your app in OAuth Playground (see [How to](#how_to_test_your_app_in_oauth_playground)).\n\nAlternative 2: Service Account\n\n- Go to `APIs & Services \u003e Credentials \u003e Create Credentials \u003e Service account`.\n- Enter service account name and click `Create`.\n- Create a key for your service account. Click `Add Key` and create \"json\" key. Keep track of the file in a secure location.\n- Use your service account with proper admin privileges for customer:\n - Customer may set up Domain-Wide Delegation and then the service account can impersonate a user/admin who has proper privileges (see [how](#how_to_enable_domain-wide_delegation))\n - or customer may grant an admin role with proper privileges to the service account directly (see [how](#how_to_manage_admin_privileges)).\n\nSetup for a customer\n\nDepending on which application type the developer created, the customer admin has different setup options.\n\n\"OAuth 2.0 Client\" Apps\n\nNo special setup is needed.\n\nApp users require proper admin privileges (see [how](#how_to_manage_admin_privileges)).\n\nApp users need to agree to the app OAuth pop-up consent screen.\nOptionally, you can allow this app to use Domain-Wide Delegation (see [how](#how_to_enable_domain-wide_delegation)), which will omit the OAuth pop-up consent screen for users.\n\nOptionally verify if the app isn't blocked, or trust the app explicitly (see [how](#how_to_block_or_trust_an_app)).\n\n\"Service Account\" Apps\n\nThe service account must be granted proper admin privileges.\nYou can do this in either of two ways:\n\n- Allow Domain-Wide Delegation so the Service Account can impersonate an admin that has proper privileges (see [how](#how_to_enable_domain-wide_delegation)).\n- Grant Admin Roles for the service account directly (see [how](#how_to_manage_admin_privileges)).\n\n\"How to\" guides\n\nHow to block or trust an app\n\n- As customer admin, go to Admin Console (https://admin.google.com/).\n- Navigate to `Security \u003e Access and data control \u003e API controls`.\n- In the `App access control` section, click `Manage third party app access`.\n- If you don't see the app in the 'Connected apps' list, you can configure a new app.\n- You can now block the app or trust the app explicitly.\n\nHow to enable domain-wide delegation\n\n- As customer admin, go to Admin Console (https://admin.google.com/).\n- Navigate to `Security \u003e Access and data control \u003e API controls \u003e Domain-wide delegation`.\n- Click `Add new`.\n- Enter client ID (\"service account unique id\" or \"app client ID\").\n- Enter all necessary OAuth scopes. Depending on the app, you may need to enter scopes for more than just Chrome Management API; e.g. the Directory API for managing devices, users, browsers, OUs, groups, etc.\n- Click `Authorize`.\n\nHow to manage admin privileges\n\nFor different portions of the Chrome Management APIs, different admin privileges\nare needed. See which admin privileges are required for\n[Reports API](/chrome/management/guides/reports_api),\n[App Details API](/chrome/management/guides/app_details_api), or\n[Telemetry API](/chrome/management/guides/telemetry_api).\n\nTo grant privileges:\n\n- As customer admin, go to Admin Console (https://admin.google.com/).\n- Navigate to `Admin roles` page.\n- Find an existing role or create a new role with the necessary privileges.\n- Assign this role to the user email address or the service account email address.\n\nHow to test your app in OAuth Playground\n\n- In Cloud Console, when creating an OAuth client ID for your app (see above [OAuth 2.0 Client IDs](/chrome/management/guides/setup#alternative_1_oauth_20_client_ids) section) select application type \"Web Applications\".\n- Enter a 'Name'.\n- To test your app, add `https://developers.google.com/oauthplayground` to the \"Authorized redirect URIs\" field. You can remove the redirect URI from your app when you're done testing.\n- Click `Create` and copy \"client ID\" and \"client secret\".\n- Go to [OAuth Playground](https://developers.google.com/oauthplayground/)\n- Click the gear icon in the top right corner ('OAuth 2.0 Configuration'), select `Use your own OAuth credentials`, and enter \"OAuth Client ID\" and \"OAuth Client secret\".\n- Follow these steps in OAuth Playground\n\n - Select \\& authorize APIs.\n\n Add `https://www.googleapis.com/auth/chrome.management.reports.readonly` (or other api scope) in the scope input field and click 'Authorize APIs'.\n Authorize using a customer admin account. Agree to the terms.\n - Exchange authorization code for tokens.\n\n Click `Exchange authorization code for tokens`. Optionally, click `Auto-refresh the token before it expires`.\n - Configure request to API.\n\n Enter your API URL in the 'Request URI' text box. Modify 'HTTP Method', 'Enter request body', etc. as per the API specification.\n For example, use the following URL to count the installed Apps in your organization: `https://chromemanagement.googleapis.com/v1alpha1/customers/my_customer/reports:countInstalledApps`"]]
