the service account file has everything in it already.
[gdrivesa]
type = drive
scope = drive
service_account_file = C:\data\rclone\rr\other\gdrive.sa\test01-xxx420-6f8144bb217f.json
contents of C:\data\rclone\rr\other\gdrive.sa\test01-xxx420-6f8144bb217f.json
{
"type": "service_account",
"project_id": "test01-309420",
"private_key_id": "xxx",
"private_key": "-----BEGIN PRIVATE KEY-----xxx-----END PRIVATE KEY-----",
"client_email": "test02@xxx.iam.gserviceaccount.com",
"client_id": "xxx",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/xxx.iam.gserviceaccount.com"
}