The correct approach is to create a new service account with the least viable privileges necessary for the required services, generate and download a JSON key, and use this key for authentication within your application. This method adheres to the principle of least privilege, ensuring that your application has only the permissions it needs to function, thereby enhancing security. Using default service accounts or service accounts with editor permissions is not recommended as they provide more permissions than necessary, violating the principle of least privilege. For more details, refer to Google's documentation on creating and managing service account keys and understanding roles.