NOT_ADS_USER error using service account and REST API

[Alexander]

Hi!

I can't figure out what is the problem. I tried almost everything (test coentent, real content, different accounts, id, etc) and got the same error every time. 

I got the app in the console with ads api enabled.

I have service account with generated key and domain-wide delegation enabled.

I have developer token.

What I do (PHP with no google library):

1. Token request.

$JWT_header = $this->_base64url_encode(json_encode(array(
"alg" => "RS256",
"typ" => "JWT"
)));
$time = time();
$JWT_claim = $this->_base64url_encode(json_encode(array(
"iss" => $this->settings["api_service_email"],
"sub" => $this->settings["api_service_email"],
"scope" => "https://www.googleapis.com/auth/adwords",
"aud" => "https://oauth2.googleapis.com/token",
"exp" => $time + 3600,
"iat" => $time
)));
$key = openssl_pkey_get_private("file://".__DIR__."/key.pem");
openssl_sign(
$JWT_header.".".$JWT_claim,
$JWT_signature,
$key,
"SHA256"
);

$curl = curl_init();
$options = array(
CURLOPT_URL => "https://oauth2.googleapis.com/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_VERBOSE => false,
CURLOPT_FAILONERROR => false,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion='.$JWT,
CURLOPT_HTTPHEADER => array(
'Content-type: application/x-www-form-urlencoded',
)
);
curl_setopt_array($curl, $options);
$response = curl_exec($curl);

$response = json_decode($response, true);

curl_close($curl);

This works well and I get the token.

With or without "sub" in claim data.

2. ads API Call

$data = array(
"pageSize" => 10000,
"query" => "SELECT ad_group_criterion.keyword.text, ad_group_criterion.status FROM ad_group_criterion WHERE ad_group_criterion.type = 'KEYWORD' AND ad_group_criterion.status = 'ENABLED'",
);

$curl = curl_init();
$options = array(
CURLOPT_URL => "https://googleads.googleapis.com/v7/customers/".$api_client."/googleAds:search",

CURLOPT_RETURNTRANSFER => true,
CURLOPT_VERBOSE => true,
CURLOPT_FAILONERROR => false,
CURLOPT_POST => false,
CURLOPT_POSTFIELDS => json_encode($data),
CURLOPT_HTTPHEADER => array(
'Authorization: Bearer '.$api_token,
'developer-token: '.$api_dev_token,
'login-customer-id: '.$api_client,
'Content-Type: application/json; charset=utf-8',
)
);
curl_setopt_array($curl, $options);
$response = curl_exec($curl);
$response = json_decode($response, true);
curl_close($curl);

This works, but I got an error every time.

[authenticationError] => NOT_ADS_USER

[message] => User in the cookie is not a valid Ads user. 

Help me understand what is wrong???

[Google Ads API Forum Advisor]

Hi Alexander,

Thank you for posting your concern.

With regard to the NOT_ADS_USER error, this error occurs when login user account / email address used to generate the access token is not associated with any Google Ads account. With this, make sure to log in with a valid Google Ads account (typically your manager account) for the OAuth flow. 

Also, I would recommend using the Desktop app flow (https://developers.google.com/google-ads/api/docs/oauth/client-library) instead and not the service account flow if you can. You can only use it unless you need a domain-specific feature (for example, impersonation). One step being incorrect means that it won't work for service accounts, which appears to be the case here.

However, if you still want to use service account, then make sure you to follow this guide and use our PHP client library to lessen the incorrect set up because as I mentioned earlier one incorrect set up and service accounts will not work. 

If the error persists after trying the provided suggestions, then please provide the email address / user account used to set up service account and complete request and response logs with request ID generated on your end to investigate. Please provide the requested details via Reply privately to author option.

Regards,

Ernie John Blanca Tacata Google Ads API Team

ref:_00D1U1174p._5004Q2I1MqE:ref

[Google Ads API Forum Advisor]

Hi Brandon,

Thank you for reaching out to us about this. In seeing that you have responded to us in another post. I just want to reiterate what has been said previously as well as what the issue and solution to this is. You will see that the NOT_ADS_USER is an error pointing to the fact that there is currently no account associated with the login information given, thus it was unable to load the API. We are then suggesting that the best way to resolve this is for you to create an account using one of the 2 methods mentioned here .

Regards,

William Pescherine Google Ads API Team

ref:_00D1U1174p._5004Q2I1MqE:ref