AuthenticationError.NOT_ADS_USER @

[Matthew Trevor]

I'm rather new to the Google Adwords API but I'm struggling with the authentication.

I've looked at the other posts that people have put on but they don't seem to relate to my issue, I think.

The process so far:

In the web app we get the Google authorisation code and this comes back fine.

We then get the Google access token fine

But when sending the soap request to get the campaign names it comes back with the following error:

 <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><ResponseHeader xmlns="https://adwords.google.com/api/adwords/cm/v201509"><requestId>000529db499dd7780a819c08570880cc</requestId><serviceName>CampaignService</serviceName><methodName>get</methodName><operations>1</operations><responseTime>877</responseTime></ResponseHeader></soap:Header><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>[AuthenticationError.NOT_ADS_USER @ ; trigger:'&lt;null&gt;']</faultstring><detail><ApiExceptionFault xmlns="https://adwords.google.com/api/adwords/cm/v201509"><message>[AuthenticationError.NOT_ADS_USER @ ; trigger:'&lt;null&gt;']</message><ApplicationException.Type>ApiException</ApplicationException.Type><errors xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AuthenticationError"><fieldPath></fieldPath><trigger>&lt;null&gt;</trigger><errorString>AuthenticationError.NOT_ADS_USER</errorString><ApiError.Type>AuthenticationError</ApiError.Type><reason>NOT_ADS_USER</reason></errors></ApiExceptionFault></detail></soap:Fault></soap:Body></soap:Envelope>

Please can anyone help?

Thanks,

Matt

[Yin Niu]

Hi Matt, 

When you get NOT_ADS_USER error, it means the login used to generate the access token is not associated with any AdWords account.

Thanks, 

Yin, AdWords API Team. 

[Matthew Trevor]

Hi Yin,

Thanks for the advice, but maybe I'm missing something with the Google app as I get back what looks to be a good result.

If I explain the path in more detail:

On our test website, the user (whilst logged into their Google Adwords account - a test MCC account at this point) clicks on a form which posts:

https://accounts.google.com/o/oauth2/auth?client_id=XXXXXXXXXXX-xxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com&response_type=code&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fadwords&redirect_uri=https://www.mysite.com/oauth2callback&access_type=offline&approval_prompt=auto

and then the user gives access to their Adwords account and this returns an authorization code:

we then on our web server request the access token with:

c:\Curl\curl -k --request POST "https://accounts.google.com/o/oauth2/token" \ --data "code=AUTHORIZATION CODE OBTAINED FROM FIRST CALL&client_id=XXXXXXXXXXXX-XXXXXXXXXXXXXXXX.apps.googleusercontent.com&client_secret=XXXXXXXXXXXXXXX&redirect_uri=https://www.mysitye.com/oauth2callback&grant_type=authorization_code" -o c:\Curl\Output00002744.txt

and this returns the token:

{

  "access_token" : "ya29.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX-XXXXX",

  "token_type" : "Bearer",

  "expires_in" : 3600,

  "refresh_token" : "1/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

}

and when our web server uses this token to request the campaigns in the account and that is when we get the result:

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><ResponseHeader xmlns="https://adwords.google.com/api/adwords/cm/v201509"><requestId>000529db499dd7780a819c08570880cc</requestId><serviceName>CampaignService</serviceName><methodName>get</methodName><operations>1</operations><responseTime>877</responseTime></ResponseHeader></soap:Header><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>[AuthenticationError.NOT_ADS_USER @ ; trigger:'&lt;null&gt;']</faultstring><detail><ApiExceptionFault xmlns="https://adwords.google.com/api/adwords/cm/v201509"><message>[AuthenticationError.NOT_ADS_USER @ ; trigger:'&lt;null&gt;']</message><ApplicationException.Type>ApiException</ApplicationException.Type><errors xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AuthenticationError"><fieldPath></fieldPath><trigger>&lt;null&gt;</trigger><errorString>AuthenticationError.NOT_ADS_USER</errorString><ApiError.Type>AuthenticationError</ApiError.Type><reason>NOT_ADS_USER</reason></errors></ApiExceptionFault></detail></soap:Fault></soap:Body></soap:Envelope>

So the user is logged in when they give us access, is this not right?

Thanks,

Matt

[Yin Niu]

Hi Matt, 

Can you verify that the account with the clientCustomerID that you used for this request has the same login email as the one that you use for requesting refresh token or it is the client account of the same manager account?  

[Matthew Trevor]

Hi Yin,

Sorry for the late reply but I've been away on holiday.

Thank you for your response.

We have not even got to requesting the refresh token, do you mean the access token?

Thanks,

Matthew

[Yin Niu]

Hi Matthew, 

NOT_ADS_USER error occurs when the logged in user is not associated with any AdWords account. In your request, you are logged in as MCC which doesn't have access to campaign service. You need to log onto the client account in order to pull campaign data.

[Matthew Trevor]

Hi Yin,

I've just signed in to the TEST Adwords user account and got an authorisation code and then the access code and then submitted the request again, it came back with:

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><ResponseHeader xmlns="https://adwords.google.com/api/adwords/cm/v201509"><requestId>00052c5e53be27000a8159c489081148</requestId><serviceName>CampaignService</serviceName><methodName>get</methodName><operations>1</operations><responseTime>55</responseTime></ResponseHeader></soap:Header><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>[AuthenticationError.NOT_ADS_USER @ ; trigger:'&lt;null&gt;']</faultstring><detail><ApiExceptionFault xmlns="https://adwords.google.com/api/adwords/cm/v201509"><message>[AuthenticationError.NOT_ADS_USER @ ; trigger:'&lt;null&gt;']</message><ApplicationException.Type>ApiException</ApplicationException.Type><errors xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AuthenticationError"><fieldPath></fieldPath><trigger>&lt;null&gt;</trigger><errorString>AuthenticationError.NOT_ADS_USER</errorString><ApiError.Type>AuthenticationError</ApiError.Type><reason>NOT_ADS_USER</reason></errors></ApiExceptionFault></detail></soap:Fault></soap:Body></soap:Envelope>

Thansk,

Matt

[Yin Niu]

Hi Matt, 

You should use your MCC account to generate client id/secret and refresh token. But when you send the request to pull Campaign data, you need to specify the client account clientCustomerID in the request header. 

If this does not solve your problem, please send the complete SOAP request and response log. You can click Reply privately to author when responding. 

[Matthew Trevor]

The scenario is we wish to get clients to log into our website and give us authority for our server to download a list of their campaigns.

Currently the developer has logged into Google and created an application and we have got the  client id/secret from that login.

who then requests the access token? the developer login or the client login?

Thanks,

matt

[Yin Niu]

Hi Matt, 

The MCC accont login requests the token. However, to pull the campaign data, you would have to specify the clientCustomerId SOAP header. 

For the use case you described, you should use OAuth 2.0 web flow. 

[Matthew Trevor]

I've tried that but it comes up the same. Going forward and when we are live, what if I'm not the MCC on one of our client accounts?

[Yin Niu]

Hi Matt, 

Please send your SOAP request and response header so we could investigate further. You can click Reply privately to author when responding. 

[Testing ForAds]

Hi Yin, 

Previously I used OAuth authentication, here I'm doing all the operations, but coming to service accounts.

I'm using service accounts, I'm getting the AuthenticationError.NOT_ADS_USER error, please help me out from this.

Thanks.

[Google Ads API Forum Advisor Prod]

Hi,

The AuthenticationError.NOT_ADS_USER error indicates that you may have generated OAuth credentials using an email which is not associated to any Google Ads accounts. To resolve this, I would recommend that you regenerate your OAuth credentials using a login email that is associated or has access to the account you wish to authenticate against.

Additionally, could you also confirm whether you are completing this setup for the AdWords API or the Google Ads API?

Thanks and regards,
Peter
Google Ads API Team

ref:_00D1U1174p._5001U8LJRg:ref

[Testing ForAds]

Hi peter, 

Thanks for the replay,

I'm not using O auth credentials, I'm using service account credentials, 

I'm facing AuthenticationError.NOT_ADS_USER error issue,

My target is integrate the ad words API using service accounts, I explain below what i done for integrating the adwords API using service accounts, plz help me out of this issue.

1) I have a developer Token,  but it is not approved, so, I created the Test Manager Account with another gmail, but this account is not linked with the account which has that developer token.

2) I created a service account with the json format and i also enabled the gsuite domain deletion by clicking on the check box.

3) I created a G-suite account, but it is not verified, anyway I'm giving authorization to service account by providing the client Id and scope in Manage Client API Access, by manually going in to the admin console.

I'm  thinking that issue is my G-suite account is not verified. Is that the reason why I'm getting this error? or Is there is any mistake other than this? 

Please help me to fix this error.

[Google Ads API Forum Advisor Prod]

Hi,

So I can better investigate, could you provide the email you used to generate your (service account) credentials? Do note that the email you use to generate your credentials should be associated or has access to a Google Ads account (your clientCustomerId) in order to avoid authentication issues in your requests using the AdWords API.

You may send the email you used using the Reply privately to author option.

[Testing ForAds]

Hi Peter,

I'm generating the credentials using the Test Manager Account. and Please check my email of test manager account is : testin...@gmail.com 

and where I'm providing the ClientCustomerId as client account(he also has the adwords account)  which was created in Test Manager Account.

 Can explain where the issue was?

[Google Ads API Forum Advisor Prod]

Hi,

Upon checking, the test MCC account which your (test) testin...@gmail.com email address is associated to currently does not have any client accounts in its hierarchy. That said, could you confirm which account(s) you specified in your request(s)?

So I can further investigate, could you provide the generated SOAP request and response logs? You may use the Reply privately to author option when sending the information I requested.

[Testing ForAds]

Sorry for the delay,

Hi peter,

Really I tried a lot to integrate the adwords api using service accounts, I have some questions, I need your help please, how can I contact you with voice.

But I'm able to integrate the adwords api using the Oauth, But coming to the service accounts, I was unable to do that one.

Please I need a Proper suggestion with voice, can you please tell how can I contact you?

[Testing ForAds]

Hi Yin,

Could you please give the solution to this below's problem.

Please read all.

Actually My target is to Integrate the ad words API.

>> Initially I integrated the adwords api using the oauth authentication, by clientId, client secret ID, Here I'm able to perform all the functionalities and also I'm the desired results. 

 [  here I'm used a developer token (1 st gmail), Which was not approved  , so I created a Test Manager Account with (another gmail ), And I created the clients under this, I created the Oauth credentials in the google api console with clienID and Client secret key.  Here I'm able to perform all the functionalities and also I'm the desired results. 

Here : Developer Token is belongs to separate gmail, and test Manager Accounts belongs to Separate account, any way Here I'm able to perform all the functionalities and also I'm the desired results, using Oauth credentials in the google api console with clienID and Client secret key.

But It is asking the authentication by showing the popup, So I don't need that scenario, I moved to Integrating the adwords api using the service accounts.

] 

These are the steps I followed to integrate the adwords api using service accounts.

> As I said Developer token is not approved, so I created the test manager account with another gmail, and I created the client accounts under the manager. I created service account with using the test Manager account email with enabling the gsuite.  and also I created the gsuite account, and given authorize to service accounts by providing the clientId and scope of the adwords api in the admin console.]

But I'm unable to integrate adwords api using the service accounts.

Please help me out of this.

[Google Ads API Forum Advisor Prod]

Hi,

My apologies as our team can only provide support through this forum or through emails. That being said, could you confirm why you chose to setup service accounts for authenticating your AdWords API requests? I asked because we usually do not recommend the use of service accounts, unless you need domain specific features (for example, impersonation). On that note, we still would recommend that you use the installed app oir web app flow instead.

However, if you indeed require to use service accounts, could you point out on which step in this guide you are having issues with? Additionally, if there are errors, could you provide any error messages, logs or screenshots so I can further investigate?

[Testing ForAds]

Hi Peter,

Sorry for the late replay,

I choose service accounts for mainly because to avoid the human authentication while getting the access tokens or refresh tokens in we auth flow.

I'm attaching the error log can you please investigate and let me know what the error I'm facing....

?xml version="1.0" encoding="UTF-8" standalone="no"?>

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

    <soapenv:Header>

        <ns1:RequestHeader xmlns:ns1="https://adwords.google.com/api/adwords/cm/v201809" soapenv:mustUnderstand="0">

            <ns1:clientCustomerId>217-364-0209</ns1:clientCustomerId>

            <ns1:developerToken>REDACTED</ns1:developerToken>

            <ns1:userAgent>Organization (AwApi-Java, AdWords-Axis/4.6.0, Common-Java/4.6.0, Axis/1.4, Java/1.8.0_211, maven, SelectorBuilder, SelectorField)</ns1:userAgent>

            <ns1:validateOnly>false</ns1:validateOnly>

            <ns1:partialFailure>false</ns1:partialFailure>

        </ns1:RequestHeader>

    </soapenv:Header>

    <soapenv:Body>

        <get xmlns="https://adwords.google.com/api/adwords/cm/v201809">

            <serviceSelector>

                <fields>Id</fields>

                <fields>Name</fields>

                <ordering>

                    <field>Name</field>

                    <sortOrder>ASCENDING</sortOrder>

                </ordering>

                <paging>

                    <startIndex>0</startIndex>

                    <numberResults>100</numberResults>

                </paging>

            </serviceSelector>

        </get>

    </soapenv:Body>

</soapenv:Envelope>

16:09:51.432 [main] INFO com.google.api.ads.adwords.lib.client.AdWordsServiceClient.soapXmlLogger - SOAP response:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">

    <soap:Header>

        <ResponseHeader xmlns="https://adwords.google.com/api/adwords/cm/v201809">

            <requestId>00058ef7bdc67c320aa7984a8a03e00f</requestId>

            <serviceName>CampaignService</serviceName>

            <methodName>get</methodName>

            <operations>1</operations>

            <responseTime>82</responseTime>

        </ResponseHeader>

    </soap:Header>

    <soap:Body>

        <soap:Fault>

            <faultcode>soap:Client</faultcode>

            <faultstring>[AuthenticationError.NOT_ADS_USER @ ; trigger:'&lt;null&gt;']</faultstring>

            <detail>

                <ApiExceptionFault xmlns="https://adwords.google.com/api/adwords/cm/v201809">

                    <message>[AuthenticationError.NOT_ADS_USER @ ; trigger:'&lt;null&gt;']</message>

                    <ApplicationException.Type>ApiException</ApplicationException.Type>

                    <errors xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AuthenticationError">

                        <fieldPath/>

                        <trigger>&lt;null&gt;</trigger>

                        <errorString>AuthenticationError.NOT_ADS_USER</errorString>

                        <ApiError.Type>AuthenticationError</ApiError.Type>

                        <reason>NOT_ADS_USER</reason>

                    </errors>

                </ApiExceptionFault>

            </detail>

        </soap:Fault>

    </soap:Body>

</soap:Envelope>

Request failed due to ApiException. Underlying ApiErrors:

  Error 0: AuthenticationError{apiErrorType=AuthenticationError, errorString=AuthenticationError.NOT_ADS_USER, fieldPath=, reason=NOT_ADS_USER, trigger=<null>}

Thanks.

[Google Ads API Forum Advisor Prod]

Hi,

The NOT_ADS_USER error is encountered when the service account has not been correctly linked to the Google Ads account via OAuth2 assertion flow. Please carefully follow this guide on how to create the service account and link it to the Google Ads account.

Regarding your concern with tokens, the refresh token process should be a one time setup and you may rarely have a need to regenerate one. As for access tokens, these should be refreshed automatically when using the client libraries as stated here. On that note, I still would strongly recommend that you use the installed app or web app flows instead as these are more simpler and easier to debug should any issues occur.