Google Adwords Api - Credentials could not be refreshed and timeout

[Nenad Pantic]

We are using Google Ad Words java library:
com.google.api.ads.adwords.lib.client

from Maven repository:

com.google.api-ads
ads-lib
4.10.0

We are experiencing random hit and miss exceptions (for example when getting list of campaigns).

It seems to me that refreshing user credentials (via web-app oauth flow) temporarily makes  it go away.

On google developer console, our app user type is external, and publishing type is in production;  Verification status is  Verification in progress.

Sensitive scope we use is Manage your AdWords campaigns.

The exception being raised is: 

Caused by: com.google.api.ads.common.lib.exception.OAuthException: Credential could not be refreshed.
Caused by: java.net.SocketTimeoutException: connect timed out

So for example, I can have this above exception, but after one hour it might not occur.
But again, it seems that user refreshing token via oauth helps (although not not blocking that it might work beyond the point of exception)

I am not at all sure what mechanics are here at play as I don't see consistency in this behaviour and asking user to re-fresh credential at random times is not good.

[Google Ads API Forum Advisor Prod]

Hi Nenad,

Thanks for reaching out. It looks like you are using the AdWords API. Can you please confirm if you are using this guide to create the refresh token?

Thanks,
Matt
Google Ads API Team

Matt Google Ads API Team

ref:_00D1U1174p._5004Q2CRvhk:ref

[Nenad Pantic]

Hi Matt,

I don't know which one I used but I can explain our flow - it should be pretty standard.

1. We invoke the oauth popup window from our web-app (our client angular ui). 
2. Once user authenticate in oauth window, google returns the auth code to our web-app
3. We send auth code received from Google to our server-side application. It uses library mentioned above.
4. Our server side application exchanges auth code for refresh token.
5. We store and use received refresh token to call Google Ads api.

On 4, we use the following method to get refresh token:

userAuthorizer()
    .getCredentialsFromCode(authorizationCode, create(baseUri))
    .getRefreshToken();

where userAuthorizer is (from com.google.auth.oauth2;)

private UserAuthorizer userAuthorizer() {

    return UserAuthorizer.newBuilder()
       .setClientId(of(clientId, clientSecret))
       .setCallbackUri(create(callbackUri))
       .setScopes(asList(scopes))
       .build();
}

Anyway, I am confused because if token was somehow invalidated by Google, it would not be valid few minutes later (without User action) - which also happens.

It puzzles what is the root cause of the error, as it seems it is caused by timeout with the message indicating problems with credentials.

Thanks for the clues.

[Google Ads API Forum Advisor Prod]

Hi Nenad,

Thanks for providing the additional info. Can you please provide us the complete request and response logs so we can see the error message in context?

[Nenad Pantic]

Hi Matt, thanks fro looking into it.

This is a stack trace from yesterday. (It might not show low level communication between our app and Google).

I should note that this is happening regardless of context - happened on production and test environments (which at this point are quite different, but within respective kubernetes clouds) and without kubernetes as well, on local machine running with docker compose.

It also seem it's transient and random in nature, coming and going. For example, I did not see single instance happening today, While happening quite often yesterday.

(It also coincides with some timeouts we get when communicating with Google Analytics, which were also bad yesterday - but no timeouts when communicating with Facebook (no offence - just minimising possibility that something is across the board on our side))

[Google Ads API Forum Advisor Prod]

Hi Nenad,

Thanks for the additional context. Please allow us to review this internally and we will provide an update as soon as possible.

[Google Ads API Forum Advisor Prod]

Hi Nenad,

With the Google Analytics timeouts you also saw, were those from requests to Google Analytics, or OAuth requests (like the ones you saw with the AdWords API)?

Thanks,
Josh, Google Ads API Team

ref:_00D1U1174p._5004Q2CRvhk:ref

[Nenad Pantic]

Hi Josh, in both cases these are requests to respective apis - so in both cases, oauth2 refresh token is collected,
but then both of them might fail at random times when executing random api endpoint
(like get list of Campaigns in Google AdWords or get list of Profiles in Google Analytics)

[Google Ads API Forum Advisor Prod]

Hi Nenad,

I mentioned OAuth because the stack trace indicates there was a connect timeout while trying to get a new access token using your refresh token, so the endpoint was the OAuth endpoint, not the AdWords API endpoint.

Caused by: com.google.api.ads.common.lib.exception.OAuthException: Credential could not be refreshed.

    at com.google.api.ads.common.lib.auth.OfflineCredentials.generateCredential(OfflineCredentials.java:240) ~[ads-lib-4.10.0.jar!/:na]
    at com.wearebionic.blite.connector.google.ads.GoogleAdsConnectorImpl.getCampaign(GoogleAdsConnectorImpl.java:139) ~[blite-google-connector-0.8.8.0-SNAPSHOT.jar!/:0.8.8.0-SNAPSHOT]
    ... 183 common frames omitted
Caused by: java.net.SocketTimeoutException: connect timed out
    at java.net.PlainSocketImpl.socketConnect(Native Method) ~[na:1.8.0_212]
    at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) ~[na:1.8.0_212]
    at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) ~[na:1.8.0_212]
    at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) ~[na:1.8.0_212]
    ...
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1012) ~[google-http-client-1.37.0.jar!/:1.37.0]
    at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:322) ~[google-oauth-client-1.30.5.jar!/:1.30.5]
    at com.google.api.client.auth.oauth2.TokenRequest.execute(TokenRequest.java:346) ~[google-oauth-client-1.30.5.jar!/:1.30.5]
    at com.google.api.client.auth.oauth2.Credential.executeRefreshToken(Credential.java:577) ~[google-oauth-client-1.30.5.jar!/:1.30.5]
    at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.executeRefreshToken(GoogleCredential.java:376) ~[google-api-client-1.30.7.jar!/:1.30.7]
    at com.google.api.client.auth.oauth2.Credential.refreshToken(Credential.java:494) ~[google-oauth-client-1.30.5.jar!/:1.30.5]

Do you see the same issue with the Google Analytics failures? Also, are you still encountering this problem?

[Nenad Pantic]

Hi Josh,

That's very nice catch. I wonder how it happens? I wouldn't say it is under our control, I would assume the library is doing heavy lifting of managing access tokens under the hood.

I only have some recent logs (for now), there was no re-occurrence of the issue (Google Ads) in last 12 hours. I will be on the lookout in the coming days.

The Google Analytics timeouts are still present, I have fresh sample (see attached). Google Analytics issue is similar to https://issuetracker.google.com/u/1/issues/176032263

[Google Ads API Forum Advisor Prod]

Hi Nenad,

It looks like the Google Analytics timeouts could be a separate issue, so I recommend following up with them on the bug you mentioned.

For the AdWords API, you're correct that the library handles periodically exchanging your refresh token for a new access token. The timeout used in that process is inherited from the OAuth library that the AdWords API library uses, so modifying the timeout would require some significant changes or workarounds. As an alternative, you could simply retry your requests on timeout. That may be the least disruptive approach, and would suffice if the timeouts during the OAuth exchange continue to be infrequent.

[章鸿]

i have some excepion with my code 

Credential oAuth2Credential =
new OfflineCredentials.Builder()
.forApi(OfflineCredentials.Api.ADWORDS)
.fromFile()
.build()
.generateCredential();
AdWordsSession session = new AdWordsSession.Builder().fromFile().withOAuth2Credential(oAuth2Credential).build();

[Google Ads API Forum Advisor Prod]

Hi,

This looks like it could be a different issue, but could you share more details of the exception such as the stack trace so I can check? Please make sure you do not share your developer token, client ID, client secret, or refresh token.