Can't get service account to work with Ads & Analytics APIs

[Josh R.]

Hello,

I need someone to help me understand what's needed to actually get data out of the Ads & Analytics API. I'm working with a client that wants me to pull in data from their Google Ads and Analytics data sources, do some tweaking, and upload it into a Google Sheet. I've looked through every document I can find about the client libraries, sample code, examples, OAuth, service accounts, and credentials and I can't figure out what's wrong. I should add I'm a senior backend engineer so I'm not new to APIs.

In working through the documentation this is what has been done so far. The client has made a project, has made an OAuth credential, has made a service account, and has enabled the Google Ads API, Google Analytics Reporting API, and the Google Sheets API. They have sent me the client_id/secret, and the .json file for the service account.

I've managed to use the sample here to create an OAuth token. However when I try to run this sample I run into the following error:

Request with ID "None" failed with status "UNAUTHENTICATED" and includes the following errors:
Request made: ClientCustomerId: XXXXXXXX , Host: googleads.googleapis.com:443, Method: /google.ads.googleads.v3.services.GoogleAdsService/SearchStream, RequestId: None, IsFault: True, FaultMessage: User in the cookie is not a valid Ads user.
        Error with message "User in the cookie is not a valid Ads user.".

My yaml file looks like this:

path_to_private_key_file: './service_account.json'

delegated_account: 'xxxxx.iam.gserviceaccount.com'

developer_token: 'fdxxxxxxxxxxxx'

I don't have a Google account that's associated with their company if that matters. Can someone help me debug what's wrong here?

Josh

[Google Ads API Forum Advisor Prod]

Hi Josh,

Thank you for reaching out to us. Looking at your logs the issue is with your OAuth Client Credentials. I see that you’re using a Service Account for your client credentials. I’d first like to strongly recommend that you use OAuth2 installed application flow instead of service accounts to access AdWords API. This is a simpler alternative that achieves the same goal, as setting up service account access tends to be complex. However, if you would like to continue with service accounts, could you please make sure that you’ve correctly configured your client credentials using these steps? Let me know if you have further questions. 

Thank you,
Bryan, Google Ads API Team

ref:_00D1U1174p._5001UXVfnr:ref

[Steve]

Hi, I also need to get help from using the service account flow. I followed all the steps but I still cant get authenticated

[Google Ads API Forum Advisor Prod]

Hi Steve,

Thank you for reaching out to us. Could you elaborate on what issue or error message you're encountering so that I may further investigate this concern?

[steve...@gmail.com]

Hi Bryan,

Yes, I am using a service account and must continue to use a service account to make an api call to Google Ads, 

I have made sure to get basic access on my manager account and I followed the instructions here :https://developers.google.com/google-ads/api/docs/oauth/service-accounts

The error that I am getting is below:

GoogleAdsException: (<_InactiveRpcError of RPC that terminated with: status = StatusCode.UNAUTHENTICATED details = "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project." debug_error_string = "{"created":"@1596563761.819611000","description":"Error received from peer ipv4:172.217.12.202:443","file":"src/core/lib/surface/call.cc","file_line":1056,"grpc_message":"Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.","grpc_status":16}" >, <_InactiveRpcError of RPC that terminated with: status = StatusCode.UNAUTHENTICATED details = "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project." debug_error_string = "{"created":"@1596563761.819611000","description":"Error received from peer ipv4:172.217.12.202:443","file":"src/core/lib/surface/call.cc","file_line":1056,"grpc_message":"Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.","grpc_status":16}" >, errors { error_code { authentication_error: NOT_ADS_USER } message: "User in the cookie is not a valid Ads user." } , 'W0dwYmKODQLb9-P03evISA')

[Google Ads API Forum Advisor Prod]

Hi Steve,

Thank you for the update and the logs. The NOT_ADS_USER error usually occurs when the login used to generate the access token is not associated with any Google Ads account. Could you check to make sure the email address used to generate the OAuth2 credentials is associated with your Google Ads account? Let me know if you have any further concerns.

[Steve p]

Hi Bryan,

I can assure you the OAuth2 credentials were indeed created with a valid Google ads Account

[Google Ads API Forum Advisor Prod]

Hi Steve,

Thank you for the clarification. Could you provide me with your full request and response logs, your Customer ID for which you're experiencing this issue, and the user email that's encountering this issue? Also, could you clarify which step you're experiencing this issue from these steps? If you're not experiencing an issue from those steps, could you clarify which service you're calling that causes this error? You can provide the logs by using "reply privately to author", or email the logs to us at googleadsa...@google.com