---
title: Connecting Google Play
nav: Connect a store
description: The eight steps from a service-account key to an imported catalogue, and what to check when one of them fails.
group: workflows
order: 1
status: shipped
updated: 2026-09-21
---

The connection flow is deliberately stepwise: each stage validates before the next begins, so a misconfiguration surfaces at the point that caused it rather than as a failed sync later.

## The steps

1. **Introduction** — what will be read, and confirmation that nothing will be written.
2. **Credentials** — paste the service-account JSON.
3. **Test connection** — authenticate against the Android Publisher API before anything is stored.
4. **Add applications** — the package names to manage.
5. **Validate application access** — confirm the service account can actually read each one.
6. **Import products** — subscriptions, base plans, offers, one-time products, purchase options.
7. **Import regional pricing** — current prices, availability, and store baselines.
8. **Completed**.

## Before you start

In Google Cloud, create a service account in the project linked to your Play Console and download its JSON key.

In Play Console, under **Users and permissions**, invite the service account's email and grant access to the apps you want to manage. Grant the monetization permission, not only _View app information_ — see [Google Play](/guidelines/google-play) for what each level actually buys you.

Google propagates permission changes over a few minutes. Connecting immediately after granting access often needs one re-sync.

## What happens to the key

The JSON key is encrypted and handed to a separate credential vault as soon as it is submitted. The application database stores an opaque random handle and a key version — never the key, and never the service-account email beyond the moment it is needed.

Authenticated calls to Google execute inside the vault worker, so the key never enters the application runtime at all. See [Credential custody](/guidelines/credential-custody).

## When a step fails

| Symptom                                         | Cause                                                                                             |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| Test connection fails immediately               | The JSON key is malformed, or the private key is invalid.                                         |
| Application access validation fails for one app | The service account was not granted access to that specific app.                                  |
| Products import but baselines do not            | A permission gap on the monetization endpoint. See [Store baselines](/guidelines/store-baseline). |
| A package is not found                          | The package name is wrong, or the developer account does not own the app.                         |

Error codes and their exact meanings are in [Error codes](/guidelines/error-codes).

## Repairing and removing a connection

A connection whose credential is missing or unreadable can be repaired in place by re-submitting the key, without re-importing the catalogue.

A stale connection can be deleted. Deleting it removes the local mirror of everything derived from it — applications, products, plans, prices, and pricing snapshots. Nothing is written to the store: deletion only discards what Paywall Parity imported, and a re-import rebuilds it.

## Re-syncing

Re-sync an application whenever you change prices in Play Console directly, grant new permissions, or want fresh store baselines.

A sync is read-only, and it is safe to run at any time. If Google refuses part of it — a conversion call fails, say — the import still completes and the failure is reported rather than discarded.