iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The dependable setup is: enable the Indexing API in a Google Cloud project, create an identity, verify the site in Search Console, grant that identity ownership of the property, and request an OAuth 2.0 token with the exact scope https://www.googleapis.com/auth/indexing. For unattended server jobs, a directly authorized service account is usually the narrowest option. Use user OAuth when a person must grant consent, and reserve domain-wide delegation for Workspace or Cloud Identity cases that genuinely require impersonation.
Authentication and authorization are separate here. Google Cloud credentials let an application obtain a token; Search Console ownership determines whether that identity may submit notifications for a particular property. A correctly configured Cloud project can still receive 403 or insufficientPermissions if the service-account email was never added as a verified owner.
What the Indexing API actually authenticates
Google requires OAuth 2.0 for every Indexing API request. Google’s authorization documentation states: “Your application must use OAuth 2.0 to authorize requests. No other authorization protocols are supported.” The required scope is exactly https://www.googleapis.com/auth/indexing, which grants read/write access for the API.
Free tools Windows power users keep installed
One-click scans. No signup required.
The API sees the identity represented by the access token. With a direct service-account flow, that identity is the service account. With user OAuth, it is the consenting user. With domain-wide delegation, a service account obtains a token while impersonating a delegated Workspace or Cloud Identity user. In all cases, the target URL must belong to a Search Console property for which the effective identity has ownership.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Choose the right identity model
| Model | Identity seen by the API | Best fit | Consent and permissions | Main risk or cost |
|---|---|---|---|---|
| Direct service account | The service account itself | Scheduled jobs, deployment pipelines and backend services | Add the service-account email as an owner of the Search Console property; grant only the Google Cloud permissions needed to operate the account and obtain tokens | A downloaded JSON key is a long-lived secret unless you use an attached or keyless identity |
| User OAuth consent | The Google user who authorized the application | Interactive tools, administrator consoles and applications acting on behalf of a person | The user grants the indexing scope through the OAuth consent flow; refresh-token storage and revocation become application responsibilities | Requires an interactive consent and a reliable token-lifecycle implementation |
| Domain-wide delegation | A service account impersonating a delegated Workspace or Cloud Identity user | Administrative environments that truly require impersonation across an organization | A Workspace or Cloud Identity administrator delegates authority, and the impersonated user must have the required Search Console ownership | Broader blast radius: a compromised service account may impersonate users across the domain; avoid it when direct access or normal consent works |
For a single site and a server-side notifier, start with a direct service account. It avoids a human sign-in during every run and does not require organization-wide impersonation. Select user OAuth when the application must let different people connect their own Search Console properties. Select delegation only after documenting why the application cannot use either of those narrower patterns.
Prerequisites before writing code
- A Google Cloud project that will own the API activation and credentials.
- The Indexing API enabled in that same project.
- A service account, or an OAuth client for an interactive user flow.
- A verified Search Console property for the site. Search Console supports both Domain properties and URL-prefix properties.
- A plan for storing tokens and, if applicable, a service-account key without exposing it in source control.
- Pages that fall within the API’s eligibility rules: pages with
JobPosting, or pages with aBroadcastEventembedded in aVideoObject.
Search Console ownership is property-specific. A service account added to one URL-prefix property does not automatically own another prefix or a separate Domain property. Make sure the URL you submit is covered by the exact property where the identity was added.
Set up a direct service account
1. Select a Cloud project and enable the API
- Open the Google Cloud project you intend to use, or create a dedicated project for the notifier.
- Enable the Indexing API in that project by using Google’s Indexing API setup flow or the Google API Console.
- Record the project identity. The credentials, quota accounting and API activation must all refer to this same project.
If credentials come from project A while the API is enabled only in project B, the request can fail even though both projects are otherwise valid. This project mismatch is one of the first checks to make when diagnosing authorization or quota errors.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →2. Create the service account
- In the project’s service-account page, create a service account with a descriptive name such as
indexing-notifier. - If your runtime cannot use an attached identity or another keyless method, create a JSON key and download it once.
- Keep the JSON file out of repositories, build logs, tickets and chat. Restrict its filesystem permissions and place it in a secret manager or equivalent protected store.
The JSON field you need for Search Console is client_email (or the service-account ID shown in Cloud). The email must be copied exactly; a display name, project owner email or OAuth client ID is not interchangeable.
3. Verify the site in Search Console
- Open Search Console for the site.
- Complete verification for either a Domain property or the specific URL-prefix property that contains the URLs your application will submit.
- Confirm that your own account appears in the property’s verified-owner list before trying to add another owner.
4. Add the service account as a verified owner
- In the property’s verified-owner management screen, choose the option to add an owner.
- Enter the service account’s exact
client_emailvalue from the JSON key, or the service-account ID displayed in Cloud. - Save the change and verify that the service account appears in the owner list.
This is a Search Console permission, not a Google Cloud IAM role. Granting a service account a Cloud project role does not give it access to a Search Console property. Conversely, adding it as a Search Console owner does not grant broad rights to other Cloud resources.
5. Obtain an OAuth 2.0 access token
Use a Google-supported authentication library to exchange the service-account credentials for a short-lived OAuth 2.0 bearer token with the scope https://www.googleapis.com/auth/indexing. Libraries perform the assertion and token exchange; your application should pass the resulting token in the request’s Authorization: Bearer header.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Access tokens normally expire after about one hour. Refresh or mint a new token when it expires; do not keep retrying with the same bearer token. If your runtime supports attached identities, workload identity or impersonation with short-lived credentials, prefer those over a downloaded key.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Use user OAuth when a person must consent
User OAuth follows the standard authorization-code pattern: register an OAuth client, send the user through a consent screen requesting https://www.googleapis.com/auth/indexing, receive an authorization result, and exchange it for access and refresh tokens. The application then calls the API as that user. The user must have ownership of the relevant Search Console property.
Choose this model when an interactive product needs to connect multiple people’s properties or when policy requires an explicit human grant. Protect refresh tokens as carefully as service-account keys, handle revocation, and make the requested scope visible to the user. A user token with unrelated scopes cannot be substituted for the indexing scope.
Understand domain-wide delegation before enabling it
Domain-wide delegation lets a service account impersonate a Workspace or Cloud Identity user after an administrator grants delegated authority. The application requests a token for the indexing scope while naming the user to impersonate; the effective Search Console permissions are those of that user.
This pattern is not an alternative spelling of direct service-account access. It introduces administrative configuration and a larger failure and security surface. Google Cloud recommends avoiding domain-wide delegation when a direct service account or ordinary user-consent flow is sufficient, because delegation can permit impersonation of users across a domain.
Use it only when the organization has a documented need for centralized impersonation. Limit delegated scopes, restrict who can use the service account, audit impersonation, and remove the delegation when the workflow ends.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Call the publish endpoint
The publish endpoint is https://indexing.googleapis.com/v3/urlNotifications:publish. Send JSON containing the URL and the notification type:
{
"url": "https://example.com/jobs/example-role",
"type": "URL_UPDATED"
}Use URL_UPDATED when an eligible page is created or materially changed. Use URL_DELETED when notifying Google that an eligible URL has been removed. Include the OAuth bearer token obtained with the indexing scope:
POST https://indexing.googleapis.com/v3/urlNotifications:publish
Authorization: Bearer ACCESS_TOKEN
Content-Type: application/json
{
"url": "https://example.com/jobs/example-role",
"type": "URL_UPDATED"
}Replace ACCESS_TOKEN with a current token; never put a service-account JSON key in the HTTP request. A client library can handle token refresh and request serialization, while the same endpoint and JSON fields apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Batching notifications
Batch requests can combine up to 100 calls. Batching reduces HTTP connection overhead, but it does not multiply quota: Google counts quota per URL rather than per HTTP connection. A batch of 100 notifications therefore consumes 100 publish units.
Cloud IAM roles versus Search Console ownership
These systems answer different questions:
- Cloud IAM: who may manage the project, service account, attached workloads or token creation.
- Search Console: which verified site property an identity may act for.
- OAuth scope: which API capability the bearer token requests.
Google Cloud documents roles/iam.serviceAccountTokenCreator as including iam.serviceAccounts.getAccessToken. That role is relevant when one principal mints a token for another service account. roles/iam.serviceAccountUser lets a principal attach a service account to a resource. Neither role grants Search Console ownership, and neither can replace adding the effective identity to the verified property.
For least privilege, separate the deployment identity that provisions infrastructure from the runtime identity that submits notifications. Give the runtime only the Cloud permissions needed to obtain its token and keep its Search Console ownership limited to the properties it must update.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Quotas, eligibility and what a success response means
| Limit | Published value | Qualification |
|---|---|---|
| Publish requests | 200 per day per project | Google Search Central documentation current in 2026; the daily quota resets at midnight Pacific Time |
| Metadata requests | 180 per minute per project | Google Search Central documentation current in 2026 |
| All requests | 380 per minute per project | Google Search Central documentation current in 2026 |
| Batch size | Up to 100 calls | Quota is still counted per URL, not per HTTP connection |
The API is not a general-purpose indexing submission channel. Its documented eligible content is a page containing JobPosting, or a BroadcastEvent embedded in a VideoObject. Submitting unrelated pages does not make them eligible and can waste quota.
An HTTP 200 response means Google accepted the notification. It does not prove that Google indexed the URL, changed its search result, or removed it. The metadata endpoint reports the latest notification Google received, not the final crawl, indexing or removal state. Check Search Console and the page’s crawl and indexing status separately.
Google also states that all submissions undergo rigorous spam detection. Attempts to abuse the API, including using multiple accounts to exceed quotas, may lead to access being revoked.
Why “permission denied” happens
The service account is not a Search Console owner
This is the most common configuration error. The Cloud project may be correct and the token may be valid, yet the API rejects the request because the token’s identity is absent from the verified property. Add the exact service-account email to the property and confirm it appears in the owner list.
The token has the wrong scope
Inspect the token-generation configuration and request exactly https://www.googleapis.com/auth/indexing. A token created for a different Google API cannot be upgraded by changing the HTTP request; mint a new token with the required scope.
The token represents a different identity
Compare the identity represented by the token with the email added in Search Console. This mismatch often occurs when a deployment uses a default compute identity while an administrator added a separately created service account, or when delegated impersonation is enabled unintentionally.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
IAM was treated as a substitute for ownership
Project Owner, Editor, Service Account User or Token Creator roles do not automatically authorize a Search Console property. Check both permission planes independently.
The API is enabled in a different project
Confirm that the project named by the credentials is the project in which the Indexing API is enabled. Also check that quota errors are being evaluated against that same project.
The bearer token expired
Short-lived service-account access tokens normally expire after about one hour. Refresh the token and retry once with the new bearer value. Repeated retries with an expired token will not recover the request.
The URL is outside the property or ineligible
Verify that the submitted URL belongs to the exact Domain or URL-prefix property where ownership was granted. Then verify that the page contains one of the supported structured-data types. Authorization cannot make an ineligible URL eligible.
A practical troubleshooting sequence
- Identify the project: confirm the API is enabled in the project associated with the credentials used at runtime.
- Inspect the token: ensure it is an OAuth 2.0 bearer token, is unexpired, and was minted with
https://www.googleapis.com/auth/indexing. - Identify the caller: determine the service-account email or delegated user represented by the token.
- Check Search Console: confirm that exact identity is a verified owner of the property containing the target URL.
- Validate the URL: check property coverage and the required
JobPostingorBroadcastEvent-in-VideoObjectstructured data. - Classify the error: distinguish
dailyLimitExceeded,quotaExceeded,rateLimitExceededandinsufficientPermissions; each points to a different fix. - Interpret success correctly: after an HTTP 200, monitor crawl and indexing results separately instead of assuming the page is already searchable.
Security practices for production
Prefer short-lived, keyless credentials
Attached identities, workload identity and controlled impersonation avoid distributing a permanent private key. Google Cloud describes short-lived credentials as less risky than long-lived service-account keys. Use the narrowest runtime identity and limit who may mint tokens for it.
If a JSON key is unavoidable
- Store it in a secret manager rather than in the application repository.
- Restrict file and secret access to the process that needs it.
- Do not print the key, its private material or bearer tokens in logs.
- Rotate the key on a schedule and immediately after suspected exposure.
- Revoke and delete the key when the integration is retired.
Control delegation and auditing
For delegated impersonation, document the administrator grant, allowed scopes, impersonated users and business justification. Review audit logs for token creation and impersonation, and remove broad delegation when a direct service account can perform the same work.
Quick Recap
Operational checklist
- The Indexing API is enabled in the credentials’ Cloud project.
- The runtime identity is known and documented.
- The site is verified as the correct Domain or URL-prefix property.
- The exact service-account email or effective delegated user is listed as a Search Console owner.
- Tokens request only
https://www.googleapis.com/auth/indexingand are refreshed before expiry. - Requests use
URL_UPDATEDorURL_DELETEDwith the publish endpoint’s required JSON shape. - URLs are eligible and inside the owned property.
- Daily and per-minute quotas are monitored, with exponential backoff for rate limits.
- HTTP 200 responses are recorded as accepted notifications, while indexing outcomes are checked independently.
- Keys, refresh tokens and delegation grants are protected, rotated and revoked when no longer needed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
