Do these steps in Google Cloud Console (console.cloud.google.com).
1. Create or select a project
Create a new project (or pick an existing one) and note its name.
2. Enable the Admin SDK API
Go to APIs & Services → Library, search for "Admin SDK API", open it and click Enable.
⚠️ This is mandatory — syncing won't work without it.
3. Create a service account
Go to APIs & Services → Credentials → Create Credentials → Service Account. Give it a name and description, click Create and Continue, skip the optional access step, and click Done.
4. Enable Domain-Wide Delegation
Open the service account → Details tab → enable "Enable Google Workspace Domain-wide Delegation" and save. Note the Client ID shown — you'll need it in the next step.
5. Create and download the JSON key
In the service account, go to the Keys tab → Add Key → Create new key → JSON → Create. The key file downloads automatically. Keep it secure — you'll paste its contents into Workspace Sync.