Server to Server OAuth2 Error - NOT_ADS_USER with python client library

[Jim 4Cite]

I am very new to the AdWords API and have done a lot of research and testing trying to authenticate and test the API. I believe I have followed the authentication flow correctly, but since I am consistently getting the same error I wanted to reach out to an AdWords API Team Member and see if they could tell me what I am missing.

I created a manager AdWords account and have my developer token, the access level is Test Accounts. I also created a Test AdWords Account with test client accounts linked. I am attempting to authenticate with a service account (I had success with service accounts for the Content API). I followed the steps on this page (for my test manager account): https://developers.google.com/adwords/api/docs/guides/authentication#setting_up_service_account_access

I am using the googleads python client library to authenticate and interact with the AdWords API. This is a snippet of my code I am using (not including the exact values of my variables)

from googleads import adwords
from googleads import oauth2
from suds import WebFault
import json


scope = 'https://www.googleapis.com/auth/adwords'
key_file_path = 'FULL PATH OF MY JSON KEY FILE'
prod_man_token = 'PRODUCTION MANAGER DEVELOPMENT TOKEN'
test_man_cust_id = 'CUSTOMER ID FOR MY TEST MANAGER ACCOUNT (XXX-XXX-XXX)'


oauth2_client = oauth2.GoogleServiceAccountClient(scope, key_file=key_file_path)
adwords_client = adwords.AdWordsClient(prod_man_token, oauth2_client, client_customer_id=test_man_cust_id)


user_list_service = adwords_client.GetService('AdwordsUserListService')
operation = {'operator': 'ADD',
             'operand': {'xsi_type': 'BasicUserList',
                         'name': 'Test List',
                         'description': 'Testing API',
                         'membershipLifeSpan': '365',
                         'conversionTypes': [],
                         # Optional field.
                         'status': 'OPEN'
                        }
            }
operations = [json.dumps(operation)]
try:
  result = user_list_service.mutate(operations)
  print result
except WebFault, e:
  print str(e)

I am able to create the oauth_client and adwords_client then use the adwords client to get the AdwordsUserListService, but when I try and execute the mutate call I get the following error:

Server raised fault: '[AuthenticationError.NOT_ADS_USER @ ; trigger:'<null>']'

Is there something I'm missing? I would be willing to give more specific account information to an API team member in a more private form.

[Bharani Cherukuri (AdWords API Team)]

Hello,

The NOT_ADS_USER error is noticed when the API call is made by a user not associated with an AdWords account. Could you please confirm if these prerequisites are met for your service account? Also, are you saying you are able to make a get call using the API without any issues and getting the error while making the mutate() call? Could you please share the client customer id along with the SOAP logs so that I can take a closer look? You could use Reply privately to author while responding.

Is there a specific reason for using service accounts? The OAuth for service account set up is recommended when you need the impersonating abilities on the same domain. If it is to avoid the manual interventions, you could achieve the same by using installed app authentication setup. The user will need to manually accept the prompt the very first time API is being accessed. This credentials are stored for future calls and for every subsequent requests, the access token (if expired) can be refreshed before making the API calls. That said, there is no manual intervention required after the first API call. The linked document for installed app has the instructions for setting up OAuth. If you would like to use any of our client libraries, they all follow the same setup. 

Thanks,

Bharani, AdWords API Team

[Jim 4Cite]

Thank you for getting back to me, I ended up being able to authenticate with the installed application flow, I didn't have G Suite Domain for the server to server flow.