The credential must be of kind `Google Service Account from private key`.

The service account you upload must have the following IAM permissions: