authentication_error: NOT_ADS_USER

[刘修南]

When calling ads API with service account, I returned error getting access token for service account: 401 unauthorized

[XiuNan Liu]

Code:

GoogleCredentials credentials = GoogleCredentials.fromStream(new FileInputStream("robotic-aviary.json")).createScoped("https://www.googleapis.com/auth/adwords", "https://www.googleapis.com/auth/adsensehost", "https://www.googleapis.com/auth/adsense");

 

credentials.refreshIfExpired();
GoogleAdsClient googleAdsClient = GoogleAdsClient.newBuilder().setCredentials(credentials).setDeveloperToken(developerToken).setLoginCustomerId(Long.valueOf(customerId)).build();
try (GoogleAdsServiceClient googleAdsServiceClient =
googleAdsClient.getLatestVersion().createGoogleAdsServiceClient()) {
String query = "SELECT campaign.id, campaign.name FROM campaign ORDER BY campaign.id";
// Constructs the SearchGoogleAdsStreamRequest.
SearchGoogleAdsStreamRequest request =
SearchGoogleAdsStreamRequest.newBuilder()
.setCustomerId(customerId)
.setQuery(query)
.build();

// Creates and issues a search Google Ads stream request that will retrieve all campaigns.
ServerStream<SearchGoogleAdsStreamResponse> stream =
googleAdsServiceClient.searchStreamCallable().call(request);

// Iterates through and prints all of the results in the stream response.
for (SearchGoogleAdsStreamResponse response : stream) {
for (GoogleAdsRow googleAdsRow : response.getResultsList()) {
System.out.printf(
"Campaign with ID %d and name '%s' was found.%n",
googleAdsRow.getCampaign().getId(), googleAdsRow.getCampaign().getName());
}
}

Log:

Request
-------
MethodName: google.ads.googleads.v10.services.GoogleAdsService/SearchStream
Endpoint: googleads.googleapis.com:443
Headers: {developer-token=REDACTED, login-customer-id=134xxxxxx, x-goog-api-client=gl-java/1.8.0_60 gccl/17.0.1 gapic/17.0.1 gax/2.6.1 grpc/1.27.2}
Body: customer_id: " 134xxxxxx  "
query: "SELECT campaign.id, campaign.name FROM campaign ORDER BY campaign.id"


Response
--------
Headers: Metadata(content-type=application/grpc,request-id=6vd9tHbU6pTfNbX_KtJ6PQ,date=Sat, 02 Apr 2022 06:25:39 GMT,alt-svc=h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43")
Body: null
Failure message: errors {
  error_code {
    authentication_error: NOT_ADS_USER
  }
  message: "User in the cookie is not a valid Ads user."
}
request_id: "6vd9tHbU6pTfNbX_KtJ6PQ"

[Google Ads API Forum Advisor]

Hi,

Thank you for reaching out to the Google Ads API support team.

The NOT_ADS_USER error usually occurs when the login used to generate the access token is not associated with any Google Ads account. Make sure to log in with a valid Google Ads account (typically your manager account) for the OAuth flow.

Could you please confirm if you’ve indeed followed every step of the service account guide , specifically the prerequisites ?

Best regards,

Heidi Google Ads API Team

ref:_00D1U1174p._5004Q2ZJ5so:ref

[XiuNan Liu]

Thanks for help,

I think I have operated according to the document. My account is Google Ad Manager Account. I used this account to create a service account, and also used this account to apply for a developer token

Then I add service account id and google ad scope( https://www.googleapis.com/auth/adwords) on admin.google.com

[Google Ads API Forum Advisor]

Hi,

Thanks for the response, I am also a member of the Google Ads API team and let me provide support to your concern.
 

Moving forward to your concern, I think you follow all the steps by giving my colleague. In this case can you provide the complete API logs (request and response with request-id)? I asked because the last time you gave us a request and response all logs are redacted.
 

Regards,

Darwin Google Ads API Team

ref:_00D1U1174p._5004Q2ZJ5so:ref

[Google Ads API Forum Advisor]

Hi,

I am also a member of the Google Ads API team and let me provide support to your concern.

I would like to inform you that I will remove your recent post with API logs for privacy purposes. Moving forward, before I raise the issue to the team, could you confirm if you already followed the Java client library setting for service account as discussed here. If yes but the issue still persists, let me know so that I can raise it to the team for further checking and to address the issue.

Also, we strongly recommend using OAuth2 desktop app or web app flow instead of service accounts unless you need a domain-specific feature (for example, impersonation). OAuth2 desktop app and web app flows do require an initial user interaction for granting access to the account, but are much simpler to set up.

For the OAuth2 desktop app flow, you can persist a refresh token (which never expires) to obtain a new access token whenever necessary. When using one of our client libraries, you can authorize your app by filling out a configuration file.

Regards,

Ernie John Google Ads API Team

ref:_00D1U1174p._5004Q2ZJ5so:ref

[XiuNan Liu]

Please help me submit my questions. For my business, the service account is the best solution, so I hope I can give priority to the service account

[Google Ads API Forum Advisor]

Hi,

Thanks for your response.
 

Moving forward to your concern, can I confirm if you followed my colleague provided about the Java client library setting for a service account as discussed here.  If yes but the issue still persists, let me know so that I can raise it to the team for further checking and to address the issue.

Regards,

Darwin Google Ads API Team

ref:_00D1U1174p._5004Q2ZJ5so:ref

[XiuNan Liu]

Yes, I have followed steps 1 and 2, but the problem still exists

[Google Ads API Forum Advisor]

Hi,

Thanks for getting back to us.

Allow me to reach out to the rest of our team so we can look into this further. We'll reach back to you once we have our findings.

Regards,

Yasar Google Ads API Team

ref:_00D1U1174p._5004Q2ZJ5so:ref

[Google Ads API Forum Advisor]

Hi,

Thank you for your patience.

However, could you please confirm if api.googleads.serviceAccountUser a valid user in CID: 1340476946? Upon checking, I see that this account is test manager account? Could you retry your request with correct correct CID? Please send sensitive details privately.

Regards,