How to solve DEVELOPER_TOKEN_PROHIBITED error ?

[rodolphe...@artefact.com]

Hello,

To request Google Ads API v1, we use oauth2 flow, using client_id/client_secret created in GCP interface and refresh_token associated with our account on google Adwords interface from google oauth2 playground.

We are trying to update our developper token as we obtained a standard access.
We were requesting Google Adwords API with no troubles with a previous API token associated with another MCC account, and the same gcp project.

Now that we change the API token, we are receiving DEVELOPER_TOKEN_PROHIBITED "Developer token 'XXXXX' is not allowed with project 'XXXXX'.

Could you please tell us which relationship lies between API token and gcp project ?
Any hints about how to solve that issue ?

Thanks for your help

Rod,

This email and any attachments contains privileged and confidential information intended only for the use of the addressee(s). If you are not an intended recipient of this email, you are hereby notified that any dissemination, copying or use of information is strictly prohibited. If you received this email in error or without authorization, please delete the email from your system and notify us immediately by sending us an email. If you need any further assistance, please send a message to he...@artefact.com.

[googleadsapi...@google.com]

Hi Rod,

If you are using a new developer token, you should generate a new OAuth2 credentials by following this guide. Then, you should also generate a new refresh token as well. Let me know if it works after trying my suggestions.

Thanks and regards,

Luis

Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Was your question answered? Please rate your experience with us by taking a short survey.
If not -- reply to this email and tell us what else we can do to help.

Take Survey

Also find us on our blog and discussion group:
http://googleadsdeveloper.blogspot.com/search/label/adwords_api
https://developers.google.com/adwords/api/community/

--
--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
 
You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwor...@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---
You received this message because you are subscribed to the Google Groups "AdWords API and Google Ads API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to adwords-api+unsubscribe@googlegroups.com.
Visit this group at https://groups.google.com/group/adwords-api.
To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/94398e22-b8fb-4f6c-b568-dfb23b0b2aa2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[rodolphe...@artefact.com]

Hello,

I've done these steps and it still doesnt work,
I had done these steps through the google oauth playground before leading to the same error though.

Another information : i have another gcp project where i created oauth2 credentials and i'm able to request google ads API with the API token but i still cant achieve this goal with the second gcp project, still failin with the same error.

I can find no informations on the documentations about how to solve that issue,

Rod

[googleadsapi...@google.com]

Hi Rod,

Upon further investigation, I found out that for a given Google Cloud project ID, the Google Ads API only allows you to use one developer token. The DEVELOPER_TOKEN_PROHIBITED error indicates that in the past, there was at least one request to your Google Ads API using OAuth credentials from the same project ID but different developer token.

The best way to resolve this issue is to create a new Google Cloud Project ID, obtain a new OAuth2 credentials from a client under the new project ID, and use those credentials in your requests with your developer token. 

Let me know if it works.

Regards,

Luis

Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Was your question answered? Please rate your experience with us by taking a short survey.
If not -- reply to this email and tell us what else we can do to help.

Take Survey

Also find us on our blog and discussion group:
http://googleadsdeveloper.blogspot.com/search/label/adwords_api
https://developers.google.com/adwords/api/community/

To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/393f9aa8-5712-4812-af0e-63f150024090%40googlegroups.com.

[cv]

Hi,

I am facing same issue.

I want to use my standard access developer token. Is this way to allow the developer token and revoke the other one?

Thanks,

[googleadsapi...@google.com]

Hi Chirag,

If you are facing the same issue, then you could do the same steps to resolved this. You could create a new Google Cloud Project ID, obtain a new OAuth2 credentials from a client under that new project ID, and use those credentials in your requests with your standard developer token.

Regards,

Luis

Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Was your question answered? Please rate your experience with us by taking a short survey.
If not -- reply to this email and tell us what else we can do to help.

Take Survey

Also find us on our blog and discussion group:
http://googleadsdeveloper.blogspot.com/search/label/adwords_api
https://developers.google.com/adwords/api/community/

To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/289a6b0b-7a12-44b7-af45-76e2333f3d55%40googlegroups.com.

[cv]

Hello Luis,

I understand your point,

But issue here is I was using my developer token to test out new API and application have already 400+ accounts map with the current project and his developer token.

I cannot ask him to relink those account again. I can take precaution not to use my token to test out application in future. So here I need to use his application token.

There must be way to eliminate this issue.

Hope you got my point.

Thanks,

[Chirag eReportz]

Hi Luis,

There must be a way to revoke developer token in use for GCP Project, as sometimes we need to test out application on our developer token as some of the USER not comfortable to share standard token with anybody.

Thanks,

adwords-api...@googlegroups.com

For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---
You received this message because you are subscribed to the Google Groups "AdWords API and Google Ads API Forum" group.

To unsubscribe from this group and stop receiving emails from it, send an email to adwords-api...@googlegroups.com.

Visit this group at https://groups.google.com/group/adwords-api.
To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/289a6b0b-7a12-44b7-af45-76e2333f3d55%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
 
You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwor...@googlegroups.com
To unsubscribe from this group, send email to

adwords-api...@googlegroups.com

For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---

You received this message because you are subscribed to a topic in the Google Groups "AdWords API and Google Ads API Forum" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/adwords-api/O8_y2xt0nGo/unsubscribe.
To unsubscribe from this group and all its topics, send an email to adwords-api...@googlegroups.com.

Visit this group at https://groups.google.com/group/adwords-api.

To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/cffa2e0a-b713-44c6-964a-3dc16989c65f%40googlegroups.com.

[googleadsapi...@google.com]

Hi Chirag,

My apologies as I could no comment on the possibility of revoking the developer token in use for GCP Project as I specialized only on Google Ads API related issues/concern. However, I would recommend to seek help on the support team of Google API Console by selecting the Help button of your Google API Console account.

Regards,
Luis

Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Was your question answered? Please rate your experience with us by taking a short survey.
If not -- reply to this email and tell us what else we can do to help.

Take Survey

Also find us on our blog and discussion group:
http://googleadsdeveloper.blogspot.com/search/label/adwords_api
https://developers.google.com/adwords/api/community/

[cv]

Hello Luis,

I think Issue is with Ads API only and not from GCP Project, Because Adwords API is allowed me to use my developer token with same GCP project and same oAuth credentials.

Please let me know regarding this.

Thanks,

[googleadsapi...@google.com]

Hello,

Firstly, you shouldn't generally even have access to more than one developer token. I'm not sure how you have multiple but you should probably consolidate down into a single one.

Secondly, updating to a new GCP project shouldn't require you to do any re-linking. The Google Ads accounts will still be linked to each other in the same hierarchy irrespective of which cloud project you're authenticating as. As long as you generate the new refresh token from an authorized user at the top-level manager account, you should be good to go.

The solution here is to generate a new project and continue from there.

Regards,

Mike, Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

[cv]

Hello Mike,

Thanks for the clarification.

[Nico B]

Hello,

we have the same issue after migrating to Google Ads API from Google Adwords API. How can we solve this?

Op maandag 11 maart 2019 22:24:49 UTC+1 schreef rodolphe...@artefact.com:

[Nico B]

Hi,

we have the same problems after migrating to Google Ads API from Google Adwordse API. How can we solve this?

Op dinsdag 19 maart 2019 13:39:51 UTC+1 schreef googleadsapi-forumadvisor:

[Google Ads API Forum Advisor Prod]

Hi Nico,

The Google Ads API only allows you to use one developer token for a given GCP (Google Cloud Project) ID. The error indicates that you may have at least one request to the Google Ads API using OAuth credentials from the same project ID but with a different developer token.

To resolve this, you will need to create a new GCP ID, obtain OAuth credentials from a client under the new project ID, and use those credentials in your requests with your developer token. You may refer to this guide as to how.

If this does not solve the issue, feel free to write back so I can further investigate. You may send the complete JSON logs and you can reply privately using the Reply privately to author option.

Thanks and regards,
Peter
Google Ads API Team

ref:_00D1U1174p._5001UBlkAT:ref

[Nick Petzold]

Hi Peter,

We are experiencing the same problem, however we definitely haven't used the same developer token as this one has been in use for over a year now and only now has the error started appearing once we have moved over to the new Ads API.

Do you have any ideas of what it may be?

Many thanks,

Nick

[Google Ads API Forum Advisor Prod]

Hi Nick,

Since you are also encountering issues with your OAuth, you may try our OAuth doctor tool to help you troubleshoot. You may find out more about this tool via this blog post.

Should the issue persist, could you open a new thread for us to continue discussion? This is just for better tracking between yours and the original author of the thread's issues.

Best regards,

Peter
Google Ads API Team

ref:_00D1U1174p._5001UBlkAT:ref

[Don Andarr]

Hello,

Thank you for offering a solution by creating a new GCP project, however the problems are:

1. All existing authenticated clients will require reauthentication which is a MAJOR problem.

2. Creating a new GCP project will require going through new OAuth consent screen verification which is very time and resource consuming both ours and google resources as well.

This issue of "One developer token" attached per GCP project was never disclosed or mentioned in any place - neither documentation, nor policies. As it is critical and can't be changed for now, which creates a big problem, please add this to your documentation

 

Is there a solution on the horizon for changing this token association or removing this requirement? What is the solution right now?

Thanks

[Google Ads API Forum Advisor Prod]

Hello Don,

Thanks for the suggestions. I will let my team know regarding the documentation update. As of now there is no other way except creating new OAuth credentials.

Regards,
Sai Teja, Google Ads API Team

ref:_00D1U1174p._5001UHG6Ve:ref

[David Navarro]

Hi, same problem. 

I want to migrate from Adwords API to Googleads API. I've createed a new project with new credentials. However, I have a problem: I've sent it for review and apparently the review process may take up to 6 weeks. 

What can I do to speed it up?

Thx!

[Google Ads API Forum Advisor Prod]

Hello David,

Thank you for writing to us. Could you please elaborate more on the review process where you have sent the new credentials for review that can take up to 6 weeks for me to assist you better? Additionally, you could follow the steps mentioned in this guide to create a new project and the set of OAuth2 credentials to make request calls against API which do not require any reviews.

Regards,
Nikisha Patel, Google Ads API Team

ref:_00D1U1174p._5001UHG6Ve:ref

[Anton Timenko]

Hi, it's August 2020 now, maybe there is some new convenient solution available? Or you still just need to create a new Google Cloud Project when DEVELOPER_TOKEN_PROHIBITED error encountered?

[Google Ads API Forum Advisor Prod]

Hello Anton,

Each company is only supposed to be working with one developer token. So, the expectation is that for each Cloud project there is only one developer token, but you can have multiple Cloud projects per developer token. For example, you may have one Cloud project for testing or a different Cloud project for a different tool in the company. That will continue to be that way as we expect every company to only use one developer token. 

As a result, if you do experience DEVELOPER_TOKEN_PROHIBITED, that means you already tied a developer token to a Cloud project and you will need to create a new Cloud project. Thanks for taking the time to double-check!

Best,
Nadine Wang, Google Ads API Team
 

ref:_00D1U1174p._5001UHG6Ve:ref

[Anton Timenko]

That’s pretty much understandable. But let’s suppose I have a an approved developer token, and accidentally made a request in my Google Cloud production project with another not approved developer token, which can only be used with test accounts. Now I have no way to use my approved token in my main production Google Cloud Project, and the only solution I have is creating an another one production project just to use it with Google Ads API, which for me looks like an ugly solution

I think it would be great to have some “reset” button to unlink already linked developer token. Google Ads API settings in Google Cloud Console is a great place where it should be. Also please take into account, that almost year passed, and there is still no information about that behavior in documentstion

[Google Ads API Forum Advisor Prod]

Hello Anton,

Thanks for caring about your fellow developers who may bump into this. We did have an information box on https://developers.google.com/google-ads/api/docs/first-call/dev-token. I've changed it from an information box to a warning box based on your feedback. It sounds like it may not have been obvious when running through the documentation. I also added a line in our Common Errors guide (https://developers.google.com/google-ads/api/docs/best-practices/common-errors#developer_token_prohibited) to make it easier for developers to figure out what to do if they do unfortunately see this.

Having a reset button is an interesting idea. I'll float it by a few people. I can't guarantee it will happen, but I'm definitely up for taking suggestions.

Take care,
Nadine, Google Ads API Team

ref:_00D1U1174p._5001UHG6Ve:ref

[Anton Timenko]

Great, thank you for understanding :)

[Google Ads API Explorer]

Hi  Nadine,

We are in similar situation as Anton Timenko  has mentioned. We have accidentally made a request in Google Cloud production project with another test developer token when you announced Google ads API v1 in 2018.

Having a reset button is an interesting idea. I'll float it by a few people. I can't guarantee it will happen, but I'm definitely up for taking suggestions.  

So just wanted to know is there any insights/ progress, as this was not documented earlier and some one like me or Anton did this accidentally, so at least we need chance to make up for mistake we did.

Thanks,

[Google Ads API Forum Advisor Prod]

Greetings!

We are still working on a more generic solution so folks can change this themselves. In the meantime, could you please reply privately to author and provide me the manager account ID where the developer token is that you accidentally used and the manager account ID where the developer token is that you WANT to use? I'll see what I can do from there.

Best,

[cv]

Hello Nadine,

I have faced similar issue and I have created new GCP project and started doing this as suggested by mike.

Can you please help? Should I share details? I really don't remember what MCC account API token I have used but I can share what API I used.

Thanks,

[Alex Gaesser]

Hey team,

This isn't a question, I just wanted to add onto this chain that I'm are experiencing this same issue and am having a hard time getting clarity. 

My issue is the TOS in the MCC account needed to be signed, but the associated gmail account is no longer accessible. To get around this without deauthorizing all the existing connected customer accounts, I did a developer token transfer to a newly-created MCC account. However, after assurances the transfer would maintain the existing access, I'm still getting a DEVELOPER_TOKEN_PROHIBITED when making calls with creds generated in the project the transferred token is supposedly already associated with.

CV describes the pain point well:

But issue here is I was using my developer token to test out new API and application have already 400+ accounts map with the current project and his developer token.

I cannot ask him to relink those account again.

At this point I'm pretty deep in an email thread spanning several Google Support departments and we're just going around in circles. Creating the new project was a non-starter, but it looks like the outcome of the token transfer is that I need to create a new GCP project, oauth client, and have to ask my customers to relink all their accounts anyway. 

[Google Ads API Forum Advisor]

Hi Alex,

 

Thanks for reaching out to the Google Ads API Team.

 

It seems that the token transfer only maintains the API access level. Based on our documentation, the manager account you select has no effect on the set of Google Ads accounts that your API token can access. With this, you will still need to generate OAuth2 credentials that has access to the accounts you would like to access via API.

 

Let me know if you have any further clarifications.

 

Regards,

Kevin Gil Soriano Google Ads API Team

ref:_00D1U1174p._5001UHG6Ve:ref

[Google Ads API Forum Advisor]

Hi Titus,

Please see my replies to your inquiries below:

1. Can we transfer the token or another solution? I don't think it matters for us which token we use as long as the users remains connected.
   • Once an API request is made with a developer token and a set of OAuth credentials, the GCP project and OAuth credentials are permanently tied to that developer token. If you are using another developer token, you will have to create a new Cloud project
2. Or can we just transfer the test token to a production token and we will not require to ask the client to reconnect again?
   • Upgrading the token's access will not have an effect on the error (nor would this require client's to reconnect)
3. If we create another project with different clientId and secret, we will need to ask our clients to reconnect again?
   • This shouldn't require clients to reconnect
4. Which solution doesn't require our clients to reconnect again?
   • As the API Compliance team may not allow you to have more than one active production developer token, it would be best to track down which account has the developer token. You can reach out to the API Compliance team to help with this through this form.

Regards,
Matt
Google Ads API Team

Matt Google Ads API Team

 

ref:_00D1U1174p._5001UHG6Ve:ref

[Google Ads API Forum Advisor]

Hi Titus,

The reason why AdWords works is AdWords doesn't have developer token GCP project pairing. Ads API has this developer token to GCP project pairing as shown in this warning.

Thank you for stating the difficulty of all your users regenerating refresh tokens if you need to create a new GCP project for Ads API. In light of your predicament, this can be fixed by a manual update of the Google Cloud project to which the developer token is associated. This change requires a manual database update, and could take a few days to complete. 

If you want to go through with this change, could you privately provide the Manager account that contains the developer token, and the Google Cloud project number (e.g. 354025419297)? The Google Cloud project ID (e.g. businessapi-197911) won’t work in this case.

Regards,

Aryeh Google Ads API Team

ref:_00D1U1174p._5001UHG6Ve:ref

[Yusuf Coskun]

Hello,

We also started getting DEVELOPER_TOKEN_PROHIBITED error in our production environment just after migrating from Adwords API to Google Ads API. As per other posts, I understand that when we make api call for the first time the developer token is associated with the GCP project. In our case I am not sure whether we made a call with a different developer token or not. We have prod and test Manager accounts, so I tried to make API calls with our test apps developer_token but it did not work as well.

Also creating a new GCP Project is not feasible in our case as well because we already have a bunch of linked accounts and it will be a total chaos to ask all the clients for re-authorization. In the previous posts it is mentioned that there is a work in progress for a more generic solution to enable us to change this association ourselves. Is there such an option available right now? Or is there any other solution -except creating a new project- currently available?

Any help would be really appreciated. Regards.

[Google Ads API Forum Advisor]

Hi Yusuf,

Thank you for following up on this thread.

Could you confirm if you are currently using more than 1 developer token, or if you have more than 1 GCP? You may note that a developer token can be used on other GCPs, however, a GCP can only be paired to only 1 developer token. From this guide, it says :

Each Google API Console project can be associated with the developer token from only one manager account. Once you make a Google Ads API request, the developer token is permanently paired to the Google API Console project. If switching to a developer token under a new manager account, you'll need to create a new Google API Console project for Google Ads API requests that use the new manager's token. If you do not use a new Google API Console project, you'll get a DEVELOPER_TOKEN_PROHIBITED error when making a request.

That said, if you have more than 1 GCP currently being used, I would recommend that you identify which was originally used in your old configuration in order to resolve the said DEVELOPER_TOKEN_PROHIBITED issue. Also, from our carryover concepts guide, you should be able to still use for the Google Ads API, both the developer token and OAuth2 credentials that you used in the AdWords API.

Best regards,

Peter Laurence Google Ads API Team

ref:_00D1U1174p._5001UHG6Ve:ref

[Yusuf Coskun]

Hi,

Thank you for the detailed explanation. We have two GCPs (test and production) and two developer tokens. I am having trouble on prod GCP and I tried both developer tokens to make api calls to prod GCP but neither of them works.

At this point, do we have any other options than creating a new GCP and going through all verification process once again?

Thanks.