Authentication error "NOT_ADS_USER"

[Simba Technologies]

I'm trying to authenticate API Request:
GET https://googleads.googleapis.com/v8/customers:listAccessibleCustomers
using Service Account Authentication with Key File and Email Id.

The Google account that I'm using is associated with a valid Google Ads Account.

I'm getting in Response:

          {

            "errorCode": {

              "authenticationError": "NOT_ADS_USER"

            },

            "message": "User in the cookie is not a valid Ads user."

          }

Request Id: z6p4eN5uL5zu5bEK1O1v5A

The email Id that I'm using has an associated Google Workspace domain account.
But in that, domain isn't verified yet for it (So will the Authentication matter?)
Let me know if this is the case or you need any additional inputs!

Thanks,

Simba

[Google Ads API Forum Advisor]

Hello Simba,

Thank you for reaching out. The NOT_ADS_USER error usually occurs when the login user account / email address used to generate the OAuth Credentials is not associated with any Google Ads account.

Could you please confirm if you’ve indeed followed every step of the guide, specifically the prerequisites?  If your service account has been correctly configured, please provide the complete request and response logs with request ID where you have encountered an error as well as the user account/email address that you're trying to set up so I can better investigate your concern.

However, kindly note that we strongly recommend using OAuth2 installed app or web flows instead of service accounts unless you need domain-specific features (for example, impersonation). OAuth2 installed application and web flows require user interaction only once, when access to the account is granted. You need to implement the code set up on your end to make calls using service accounts.

Reminder: Share your feedback about the Google Ads (AdWords) API! Take the 2021 Google Ads API and AdWords API Annual Survey

Best regards,

Jakeia Sabrina Google Ads API Team

 

ref:_00D1U1174p._5004Q2RA6ll:ref

[Simba Technologies]

The email Id I used to generate OAuth Credentials:
SimbaTechnolo...@gmail.com

The email Id I used to logging into Admin Console:
SimbaTechnolo...@simba.com

I'm adding here logs of Request and Response for you to investigate further!

Request Logs:

GET /v8/customers:listAccessibleCustomers HTTP/1.1

developer-token: xxxx

Authorization: Bearer xxxx

User-Agent: PostmanRuntime/7.26.8

Accept: */*

Postman-Token: xxxx

Host: googleads.googleapis.com

Accept-Encoding: gzip, deflate, br

Connection: keep-alive

Response Logs:

HTTP/1.1 401 Unauthorized

Request-Id: mnOtDcvsTWZKRann9_0GGA

Vary: Origin

Vary: X-Origin

Vary: Referer

Content-Type: application/json; charset=UTF-8

Date: Mon, 22 Nov 2021 07:51:24 GMT

Server: ESF

Cache-Control: private

X-XSS-Protection: 0

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options: nosniff

Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Content-Length: 696

{

  "error": {

    "code": 401,

    "message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",

    "status": "UNAUTHENTICATED",

    "details": [

      {

        "@type": "type.googleapis.com/google.ads.googleads.v8.errors.GoogleAdsFailure",

        "errors": [

          {

            "errorCode": {

              "authenticationError": "NOT_ADS_USER"

            },

            "message": "User in the cookie is not a valid Ads user."

          }

        ],

        "requestId": "mnOtDcvsTWZKRann9_0GGA"

      }

    ]

[Google Ads API Forum Advisor]

Hello Simba,

Thanks for providing all the information. It seems your domain is not verified yet for service account.

It's important because the user impersonation is controlled only at the domain level, using service accounts and assertion flow with Google OAuth2 requires you to have your own domain registered with Google Workspace. Your application and its users will have the ability to impersonate any user in the domain. So the user has to be an impersonated workspace account that has access to the ads account trying to be reached.

Reminder: Share your feedback about the Google Ads (AdWords) API! Take the 2021 Google Ads API and AdWords API Annual Survey

Best Regards,