Cannot access client's campaigns via API

[Jakub Hancin]

Hello,

I am trying to access client's campaigns via Google Ads API but I am failing.

I am getting this error:

"errorCode": { "authorizationError": "USER_PERMISSION_DENIED"},
 "message": "User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid"

I have gone countless times through the standards, so let me recap what I have done and tried so far.

To be perfectly clear, the 'client' is a real account using real ads, but still under our control for test purposes. We have full control over the client in this example.

1. We have added the Customer account (789-584-XXXX) to the list of Sub-Accounts via the UI on the Master Manager account (506-141-XXXX).
2. The client (us again) confirmed the linking of these accounts together and granted access to the Manager account. The Manager account can easily access all the ads of the client account via UI and can see the full history of the client (we want to be able to perform this via API).
3. The client was sent the link to provide consent. The consent was given and an Authorization code was generated.
4. The Authorization code was used to generate a pair of tokens. Up to this point, everything went successfully as expected.
5. When the tokens are used to access client's data, we get the 403 error. "User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid"

The step 5 is where our code fails.

Let me write here the details of the HTTP request. As I trust these matters are handled by seasoned developers, I believe you can easily figure out the meaning of the code below. We are using a config object where the variables are stored. No hyphens are used for the accounts, so the values look like this: 789584XXXX or 506141XXXX:

req.setMethod('POST');
req.setHeader('Content-Type','application/json');
req.setHeader('login-customer-id',config.ManagerAccountId__c);
req.setHeader('Authorization','Bearer '+config.AccessToken__c);
req.setHeader('developer-token',config.DeveloperToken__c);
req.setEndpoint('https://googleads.googleapis.com/v4/customers/'+config.ClientId_Account__c+'/googleAds:search');
req.setBody('{"pageSize": 10000,"query": "SELECT campaign.id,campaign.name, campaign.status, campaign.end_date, campaign.start_date, metrics.cost_micros, campaign.campaign_budget FROM campaign"}');

We are failing miserably.

We have tried the approach of generating credentials under the client's account and retrying the whole authorization flow with new client ID and client secret (talking now abou the app client id + secret), but we could not even get to the Authorization code as Google rejected the new app on the client's side explaining the app is only in test mode (it is true that we have the Basic access only on the Master manager account, because getting even the Basic access was a huge bureaucratic pain for us -> we do hope we do NOT have to submit the app for basic access for each client).

Thank you for any help.

Jakub
SaaScend

[Jakub Hancin]

I would appreciate any sorts of help please.

[AdWords API and Google Ads API Forum]

Reposting the last inquiry from the forum as it wasn't routed to our support queue.

Thanks,

Lakshmi, Google Ads API Team

[Google Ads API Forum Advisor Prod]

Hi Jakub,

My apologies for the delayed response. Allow me to provide support to your concern.

The USER_PERMISSION_DENIED error occurs when authenticating as a user with access to a manager account but not specifying login-customer-id in the request. With this, you need to specify the login-customer-id as the manager account ID without hyphens (-).

If the issue persists after trying the provided suggestion, then please provide the following details below via Reply privately to author option to further investigate:

• Customer ID
• email address / user account that has access to the MCC account and used to generate Oauth2 credential
• complete request and response logs with request ID generated on your end where we can see this error

Regards,

Ernie John Blanca Tacata Google Ads API Team

ref:_00D1U1174p._5004Q2Dxld3:ref

[Jakub Hancin]

I am not able to use the Reply privately to author option.
I can only reply all.

Please, contact me on ja...@saascend.com privately so that we can handle this.

Thank you.

Jakub
SaaScend

[Jakub Hancin]

Hello Ernie John Blanca Tacata,

could you please provide me your email address so that we can tackle this together?

Jakub

SaaScend

[Google Ads API Forum Advisor Prod]

Hi Jakub,

My apologies for the delayed response. I can see that you've created a new forum thread for this concern. Let us continue the discussion there.