Google Cloud service accounts are designed to authenticate and authorize requests to Google APIs.

If your application interacts with Google Cloud services then it requires a service account to access all the resources it needs to function properly. Resources that can be accessed depend on the permission granted to the service account. Establishing the identity of a service account relies on a public/private key pair. It's common for private keys to be distributed through a JSON file that your application will then use to consume Google APIs.

A key may authenticate to a high privilege which has unrestricted access to all resources in your Google Cloud project, including billing information.
