Google Document AI Setup

Guide for configuring Google Cloud Document AI for OCR processing.

Prerequisites

• Google account with access to Google Cloud Console
• A GCP project with billing enabled
• gcloud CLI installed and authenticated

Automated Setup (Recommended)

The setup script automates all configuration steps.

Usage

# Production setup
./scripts/env-setup/ingestion/doc-ai.sh \
  --project-id "getorcha-prod" \
  --output "credentials/google-docai-prod.json"

# Development setup
./scripts/env-setup/ingestion/doc-ai.sh \
  --project-id "getorcha-dev" \
  --output "credentials/google-docai-dev.json"

Parameters

What the Script Does

1. Enables Document AI API
2. Creates an OCR processor in the specified region
3. Creates a service account (docai-processor@PROJECT.iam.gserviceaccount.com)
4. Grants roles/documentai.apiUser to the service account
5. Overrides org policy to allow service account key creation (if needed)
6. Generates and saves the service account key

Manual Setup

If you prefer to configure manually, follow these steps.

Step 1: Enable Document AI API

gcloud services enable documentai.googleapis.com --project=YOUR_PROJECT_ID

Step 2: Create OCR Processor

Using the REST API (gcloud doesn't have documentai commands):

curl -X POST \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d '{"type": "OCR_PROCESSOR", "displayName": "orcha-ocr"}' \
  "https://eu-documentai.googleapis.com/v1/projects/YOUR_PROJECT_ID/locations/eu/processors"

Note the processor-id from the response (e.g., 2ce14f950a811b13).

Step 3: Create Service Account

gcloud iam service-accounts create docai-processor \
  --display-name="Document AI Processor" \
  --description="Service account for Document AI OCR processing" \
  --project=YOUR_PROJECT_ID

Step 4: Grant Permissions

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:docai-processor@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/documentai.apiUser"

Step 5: Create Service Account Key

If your organization blocks key creation, override the policy first:

cat > /tmp/allow-sa-keys.yaml << 'EOF'
name: projects/YOUR_PROJECT_ID/policies/iam.disableServiceAccountKeyCreation
spec:
  rules:
    - enforce: false
EOF

gcloud org-policies set-policy /tmp/allow-sa-keys.yaml --project=YOUR_PROJECT_ID

Then create the key:

gcloud iam service-accounts keys create credentials/google-docai.json \
  --iam-account=docai-processor@YOUR_PROJECT_ID.iam.gserviceaccount.com

Configuration

config.edn Structure

:transcription {:ocr {:provider         :ocr
                      :project-id       #profile {:local-dev "getorcha-dev"
                                                  :default   #orcha/param "GOOGLE_CLOUD_PROJECT"}
                      :location         "eu"
                      :processor-id     #profile {:local-dev "2ce14f950a811b13"
                                                  :default   #orcha/param "GOOGLE_DOCAI_PROCESSOR_ID"}
                      :credentials-file #profile {:local-dev "credentials/google-docai-dev.json"
                                                  :default   nil}}}

Environment Variables (Production)

Production Authentication Options

Option 1: Service Account Key File

• Store key in AWS Secrets Manager
• Inject as file at deploy time
• Set GOOGLE_APPLICATION_CREDENTIALS env var

Option 2: Workload Identity Federation (recommended for AWS)

• No key file needed
• AWS IAM role assumes GCP service account
• Requires additional GCP configuration

Available Processor Types

We use OCR_PROCESSOR for general text extraction. Consider INVOICE_PROCESSOR for better invoice-specific extraction.

Regions

Document AI is available in these regions:

We use eu for GDPR compliance.

Troubleshooting

"Key creation is not allowed on this service account"

Your organization has iam.disableServiceAccountKeyCreation policy enabled. Override it at project level:

cat > /tmp/allow-sa-keys.yaml << 'EOF'
name: projects/YOUR_PROJECT_ID/policies/iam.disableServiceAccountKeyCreation
spec:
  rules:
    - enforce: false
EOF

gcloud org-policies set-policy /tmp/allow-sa-keys.yaml --project=YOUR_PROJECT_ID

"Permission denied" on processor creation

Ensure you have roles/documentai.editor or roles/owner on the project.

"Processor not found" at runtime

• Verify processor ID matches what's in config
• Verify location matches (e.g., eu vs us)
• Check service account has roles/documentai.apiUser

Slow processing or timeouts

• Document AI has quotas; check usage in GCP Console
• Large documents may need increased timeouts
• Consider using async/batch processing for large volumes

API Quotas

Default quotas (can be increased via GCP Console):

References

• Document AI Overview
• OCR Processor
• Processor Management
• Authentication