To make the Apigee API calls described later in this topic, you need to get an authorization
token that has the Apigee Organization Admin role.
If you are not the owner of the Google Cloud project that is associated with your Apigee hybrid
organization, be sure that your Google Cloud user account has the roles/apigee.admin (Apigee
Organization Admin) role. You can check the roles assigned to you with this command:
If you do not have roles/apigee.admin, add the Apigee
Organization Admin role to your user account. Use the following command to add the
role to your user account:
Get the email address for the service account to which you are granting synchronizer access.
For non-production environments (as suggested in this tutorial) it should be
apigee-non-prod. For production environments, it should be
apigee-synchronizer. Use the following command:
gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee-synchronizer"
Call the
setSyncAuthorization
API to enable the required permissions for Synchronizer using the following command:
You have now enabled your Apigee hybrid runtime and management planes to
communicate. Next, install cert-manager to enable Apigee hybrid to interpret and manage
certificates.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-26 UTC."],[[["\u003cp\u003eThis document guides users on obtaining an authorization token for Apigee API calls, which requires the \u003ccode\u003eroles/apigee.admin\u003c/code\u003e role in the Google Cloud project.\u003c/p\u003e\n"],["\u003cp\u003eUsers can verify their assigned roles using the \u003ccode\u003egcloud\u003c/code\u003e command and add the Apigee Organization Admin role if it's missing.\u003c/p\u003e\n"],["\u003cp\u003eThe document explains how to retrieve \u003ccode\u003egcloud\u003c/code\u003e authentication credentials for Linux/MacOS and Windows environments, storing it in the environment variable \u003ccode\u003e$TOKEN\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eIt also provides instructions on how to enable synchronizer access by getting the appropriate service account email and using the \u003ccode\u003esetSyncAuthorization\u003c/code\u003e API call.\u003c/p\u003e\n"],["\u003cp\u003eAfter enabling synchronizer access, the \u003ccode\u003egetSyncAuthorization\u003c/code\u003e API can be called to confirm that the service account has been set up correctly.\u003c/p\u003e\n"]]],[],null,["# Step 7: Enable Synchronizer access\n\n| You are currently viewing version 1.11 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nGet an authorization token\n--------------------------\n\n\nTo make the Apigee API calls described later in this topic, you need to get an authorization\ntoken that has the Apigee Organization Admin role.\n\n1. If you are not the owner of the Google Cloud project that is associated with your Apigee hybrid organization, be sure that your Google Cloud user account has the **roles/apigee.admin** (Apigee Organization Admin) role. You can check the roles assigned to you with this command: \n\n ```\n gcloud projects get-iam-policy ${PROJECT_ID} \\\n --flatten=\"bindings[].members\" \\\n --format='table(bindings.role)' \\\n --filter=\"bindings.members:your_account_email\"\n ```\n\n\n For example: \n\n ```transact-sql\n gcloud projects get-iam-policy my-project \\\n --flatten=\"bindings[].members\" \\\n --format='table(bindings.role)' \\\n --filter=\"bindings.members:myusername@example.com\"\n ```\n\n\n The output should include `roles/apigee.admin`.\n2. If you do not have `roles/apigee.admin`, add the **Apigee\n Organization Admin** role to your user account. Use the following command to add the role to your user account: \n\n ```\n gcloud projects add-iam-policy-binding ${PROJECT_ID} \\\n --member user:your_account_email \\\n --role roles/apigee.admin\n ```\n\n\n For example: \n\n ```\n gcloud projects add-iam-policy-binding my-project \\\n --member user:myusername@example.com \\\n --role roles/apigee.admin\n ```\n3. On the command line, get your `gcloud` authentication\n credentials using the following command:\n\n ### Linux / MacOS\n\n ```\n export TOKEN=$(gcloud auth print-access-token)\n ```\n\n To check that your token was populated, use `echo`, as the\n following example shows: \n\n ```\n echo $TOKEN\n ```\n\n This should display your token as an encoded string.\n\n ### Windows\n\n ```\n for /f \"tokens=*\" %a in ('gcloud auth print-access-token') do set TOKEN=%a\n ```\n\n To check that your token was populated, use `echo`, as the\n following example shows: \n\n ```\n echo %TOKEN%\n ```\n\n This should display your token as an encoded string.\n\nEnable synchronizer access\n--------------------------\n\n\nTo enable synchronizer access:\n\n1. Get the email address for the service account to which you are granting synchronizer access. For non-production environments (as suggested in this tutorial) it should be `apigee-non-prod`. For production environments, it should be `apigee-synchronizer`. Use the following command: \n\n ```\n gcloud iam service-accounts list --project ${PROJECT_ID} --filter \"apigee-synchronizer\"\n ```\n2. Call the [setSyncAuthorization](/apigee/docs/reference/apis/apigee/rest/v1/organizations/setSyncAuthorization) API to enable the required permissions for Synchronizer using the following command: \n\n ```\n curl -X POST -H \"Authorization: Bearer ${TOKEN}\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/${ORG_NAME}:setSyncAuthorization\" \\\n -d '{\"identities\":[\"'\"serviceAccount:apigee-synchronizer@${ORG_NAME}.iam.gserviceaccount.com\"'\"]}'\n ```\n\n\n Where:\n - **`${ORG_NAME}`**: The name of your hybrid organization.\n - **\u003cvar translate=\"no\"\u003eapigee-synchronizer\u003c/var\u003e`${ORG_NAME}.iam.gserviceaccount.com`**: The email address of the service account.\n\n | **Tip:** Some shells may return an error like `bad substitution`. In this case, replace \u003cvar translate=\"no\"\u003e${ORG_NAME}\u003c/var\u003e with the name of your organization and replace the `\"'\"` with `\"` as follows: \n |\n | ```\n | curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n | -H \"Content-Type:application/json\" \\\n | \"https://apigee.googleapis.com/v1/organizations/YOUR_ORG_NAME:setSyncAuthorization\" \\\n | -d '{\"identities\":[\"serviceAccount:apigee-synchronizer@YOUR_ORG_NAME.iam.gserviceaccount.com\"]}'\n | ```\n3. To verify that the service account was set, use the following command to call the API to get a list of service accounts: \n\n ```\n curl -X GET -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/${ORG_NAME}:getSyncAuthorization\"\n \n ```\n\n\n The output looks similar to the following: \n\n ```transact-sql\n {\n \"identities\":[\n \"serviceAccount:apigee-synchronizer@\u003cvar translate=\"no\"\u003emy_project_id\u003c/var\u003e.iam.gserviceaccount.com\"\n ],\n \"etag\":\"BwWJgyS8I4w=\"\n }\n ```\n | **Note:** The call to the Apigee API uses \u003cvar translate=\"no\"\u003e${ORG_NAME}\u003c/var\u003e, and the results from the IAM service account mappings use \u003cvar translate=\"no\"\u003emy_project_id\u003c/var\u003e. In most cases, the values are the same. One uncommon exception is when using a [multi-org cluster](/apigee/docs/hybrid/latest/multi-org), where there would be more than one org name, and the service accounts could be different per org.\n\nYou have now enabled your Apigee hybrid runtime and management planes to\ncommunicate. Next, install cert-manager to enable Apigee hybrid to interpret and manage\ncertificates.\n[1](/apigee/docs/hybrid/v1.11/helm-install-create-cluster) [2](/apigee/docs/hybrid/v1.11/helm-install-download-charts) [3](/apigee/docs/hybrid/v1.11/helm-install-create-namespace) [4](/apigee/docs/hybrid/v1.11/helm-install-service-accounts) [5](/apigee/docs/hybrid/v1.11/helm-install-create-tls-certificates) [6](/apigee/docs/hybrid/v1.11/helm-install-create-overrides) [7](/apigee/docs/hybrid/v1.11/helm-install-enable-synchronizer-access) [(NEXT) Step 8: Install cert-manager](/apigee/docs/hybrid/v1.11/helm-install-cert-manager) [9](/apigee/docs/hybrid/v1.11/helm-install-crds) [10](/apigee/docs/hybrid/v1.11/helm-install-check-cluster) [11](/apigee/docs/hybrid/v1.11/helm-install-helm-charts) [12](/apigee/docs/hybrid/v1.11/helm-install-workload-identity)\n\n\u003cbr /\u003e"]]