Authentication Issue - Migrating from Adwords API to Google Ads API

[Moshe Shechter]

Hello,

We are in the process of migrating from the adwords API to the Google Ads API, and are encountering an authentication issue. We are using the python client libraries.

For a given user and accounts (tested multiple combinations), we easily access accounts and reports via the adwords API, but are unable to do so through the Google Ads API. The issue appears to be related to the access set up of the accounts themselves. We manage all our accesses through manager accounts, and therefore users have inherited access from the manager account onto the ad accounts (sometimes the hierarchy is 4/5 levels deep). The issue is resolved when the user is granted direct access to the account (without changing a single line of code). This seems to be in contradiction to the idea of manager accounts.

Since we are able to perform all action via the adwords API, this does not seem like an access issue, and since adding direct access to an account resolves the issue, it seems to rule out an authentication flow issue with the new API.

Any thoughts? I would be happy to share sample code if needed.

Thanks,

Moshik

[Google Ads API Forum Advisor]

Hi Moshik,

Thank you for raising your concern.

You may refer to this document as it discussed the structure of all API calls, especially this section as it explained what you need to set in the login-customer-id and where the user account / email address used to generate the Oauth2 credential should have access.​​​​​

Regards,

Ernie John Blanca Tacata Google Ads API Team

ref:_00D1U1174p._5004Q2JYa3Y:ref

[Boshy Zhao]

Hi Ernie And Moshik

Sorry to bother you both.

I am having the same issue as Moshik.

I have looked over the documentation and am still confused sorry.

If I am using the python sdk and using the load_from_dict() method.

By adding the login-customer-id and client _id to the dict credentials will this work?

here is a sample of my script below

from google.ads.googleads.client import GoogleAdsClient

from google.ads.googleads.errors import GoogleAdsException

credentials = {

    "developer_token": MCC DEVELOPER TOKEN,

    "refresh_token": "xxxxxxx,

    "client_secret": xxxxxx,

    "login-customer-id" :MCC_ID,

    "customer_id" : ACCOUNT_ID,

    "access_token" : XXXXX'

     }

client = GoogleAdsClient.load_from_dict(credentials)

The account sits under an mcc that sits under another mcc.

which combination of developer token, mcc id for the login-customer-id should I use?

This all renders fine

but when I then go on to execute rendering the report with the below code

customer_id= ACCOUNT_ID

ga_service = client.get_service("GoogleAdsService")

query = """

        SELECT

          campaign.id,

          campaign.name

        FROM campaign

        ORDER BY campaign.id"""

    # Issues a search request using streaming.

response = ga_service.search_stream(customer_id=customer_id, query=query )

it always gives this error:

  message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid" }

Apologies can u please elaborate some more.  

For reference the oauth2 is working correctly and i have successfully gotten the refresh token. The app type is desktop.

Many thanks

Bosh

[Moshe Shechter]

Hi Bosh,

Just to add to that (I am experiencing the exact same thing - script is similar), the issue is resolved on my side when I add the user (whose refresh token we are using) directly to the account (login-customer-id is left unchancged), but that is not a solution.  We can use the refresh token to successfully fetch the list of manager accounts (does not require the login-customer-id) but then the failure takes place on the ad account level (where we do add the login-customer-id). My next step is to try to map the hierarchy of the user access using something similar to this sample, which may provide some more insight.

Thanks,

Moshik

[Boshy Zhao]

Thanks so much for replying Moshik!

Sorry I wanted to ask what level of access is your developer token ? 

I think the error for us might be happening because ours is currently set to test?

https://groups.google.com/g/adwords-api/c/xTTwz4XzXAE/m/Mxn9V8EwAAAJ

This is the link i think to the documentation.

https://developers.google.com/google-ads/api/docs/access-levels#access_levels

here are some snipits.

Test account access

Once you complete the initial signup for the Google Ads API, you will be issued a developer token with the test account access level. This means that the developer token can only make Google Ads API requests against test accounts.

Basic access

Basic access allows the developer token to make Google Ads API requests against both test accounts and production accounts. Production accounts are any accounts that serve real, live Google ads (test accounts do not serve ads).

Basic access level allows the developer token to execute up to 15,000 requests per day and 1,000 get operations per day. This is sufficient for most developers.

Would you mind confirming?

many thanks!

Boshy

[Google Ads API Forum Advisor]

Hi Boshy,

I work with Ernie and allow me to assist you.

The "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\'" error usually comes along when the user_permission_denied error is encountered.

To avoid this, you will need to ensure that the OAuth2 credentials you are using was generated by a user / email address that has access to the Google Ads account specified in your API request. If the user / email address used to generate the credentials is one that is associated to the MCC / manager Google Ads account, then you will need to specify the MCC / manager account's ID as the login-customer-id in the API request.

Should the issue persist, and so our team can take a closer look at the issue, could you share the user / email address used, and also the complete request and response logs, with the request-id?

If you haven't yet, logging can be enabled by navigating to the Client libraries > Your client library (ex. Java) > Logging documentation, which you can access from this link.

You may then send the requested information via the Reply privately to author option. If this option is not available, you may send the details directly to our googleadsa...@google.com alias instead.

Best regards,

Peter Laurence Napa Oliquino Google Ads API Team

ref:_00D1U1174p._5004Q2JYa3Y:ref

[Moshe Shechter]

Hi Peter,  Boshy,

Just to address Boshy's previous question, we are using a production developer token, so that should not be an issue. We are able to execute the calls with the adwords API.

@Peter - I have been doing exactly as you mentioned, adding the manager account as part of the authentication package, under login-customer-id, and still receive this error (indeed a user_permission_denied). We have an account structure that is several manager accounts deep (users are provided access to the relevant manager account, and not directly to the ad accounts), and have tried all manager accounts as the login-customer-id with no success.  When access is granted to a user directly to an account the issue is resolved.

How can we proceed?

Thanks,

Moshik

[Daniel Garstin]

I am having the same issue as above. I am able to authenticate when using the 'load_from_storage' method however when using 'load_from_dict' it says I don't have permissions. 

[Daniel Garstin]

Ahh I found the issue. Simple mistake in the end. When creating your dict, make sure 'login-customer-id' is 'login_customer_id' instead.

On Monday, July 12, 2021 at 7:43:26 AM UTC+1 mo...@abagada.com wrote:

[Google Ads API Forum Advisor]

Hi Daniel,

Thank you for commenting on this forum post. I am happy to know also that you've fixed the error on your end.

In addition to what you've mentioned, please note that the format of login-customer-id will be varied based on the client library (list of supported client libraries here) that you are using. With this, I would suggest checking the Configuration document (Client library (e.g. Python) > Configuration) first of the client library that you are using to know the correct format.

Let me know if you have further questions.

Regards,

Ernie John Blanca Tacata Google Ads API Team

ref:_00D1U1174p._5004Q2JYa3Y:ref

[Ellis Crosby]

@moshik

Did you find any solution? I have encountered the same issue as you when migrating from Adwords to Google Ads API but haven't found any solution yet

Thanks,

Ellis

[Google Ads API Forum Advisor]

Hi Ellis, 

Thank you for reaching out to our API support team as well.

So our team can investigate the issue you observed on your end, could you share with our team additional details such as the complete request and response logs, with the request-id, generated when the issue occured?

You may then send the requested information via the Reply privately to author option. If this option is not available, you may send the details directly to our googleadsa...@google.com alias instead.

Best regards,

Peter Laurence Napa Oliquino Google Ads API Team

ref:_00D1U1174p._5004Q2JYa3Y:ref

[Moshe Shechter]

Hi Ellis,

The issue I had encountered was a rather silly one.  Depending on your authentication flow (from storage, YAML file or string, or dict) with python, the login-customer-id flag - which is the account number seen when clicking on the user's google account logo/picture on the right hand side of the UI to switch accounts - is written as  login_customer_id (underscores rather than dashes).  Example below:

        credentials = {

            "developer_token": "XXXXXX",

            "refresh_token": "XXXXXXX",

            "client_id": "XXXXXXXXXXX",

            "client_secret": "XXXXXXXXXXXXXXXXX",

            "login_customer_id" : "##########",

            "use_proto_plus":False}

        googleads_client = GoogleAdsClient.load_from_dict(credentials,version="v9")

I'm not sure if that is the issue you are encountering, but hopefully this helps.

Moshik