Unexplained Authorization Error

[Noah]

Hello,

My developer key was approved.
I had a client give me access via OAuth2.  Have the access and refresh tokens.
Trying a very simple connection to list campaigns.
Getting an error:  adspygoogle.adwords.AdWordsErrors.AdWordsAuthenticationError: [AuthorizationError.USER_PERMISSION_DENIED @ ; trigger:'<null>']

Can't figure out why I'm getting that error, or how to fix it.

Below is the code I'm using.  (All data, keys, etc. are fake)

Any suggestions on how to troubleshoot/solve this??

Thanks!

=============================================

email = 'f...@bar.com'
client_customer_id = '123-456-789'
oauth2_client_id = '000000.apps.googleusercontent.com'
oauth2_client_secret = '00000000000000000000000'
developer_token = '00000000000000000000000'
access_token = '00000000000000000000000'
refresh_token = '00000000000000000000000'

# Build Credential object with our tokens
credentials = OAuth2Credentials("irrelevant access token",
    oauth2_client_id, # Client ID
    oauth2_client_secret,
    refresh_token,
    datetime.datetime.now(), # token expiry
    "https://accounts.google.com/o/oauth2/token",
    "test client")

# Create the AdWordsUser and set the OAuth2 credentials.
client = AdWordsClient(headers={
  'developerToken': developer_token,
  'clientCustomerId': client_customer_id,
  'userAgent': 'OAuth2 Example',
  'oauth2credentials': credentials
})


# OAuth2 credential objects can be refreshed via credentials.refresh() - the
# access token expires after 1 hour.
credentials.refresh(httplib2.Http())
print 'Credentials Refreshed!'


# Get all campaigns.
# Construct selector and get all campaigns.

campaign_service = client.GetCampaignService(version='v201302')

selector = {
  'fields': ['Id', 'Name', 'Status']
}
campaigns = campaign_service.Get(selector)[0]

# Display results.
if 'entries' in campaigns:
    for campaign in campaigns['entries']:
      print ('Campaign with id \'%s\', name \'%s\' and status \'%s\' was found.'
             % (campaign['id'], campaign['name'], campaign['status']))
else:
    print 'No campaigns were found.'

 

[Anash P. Oommen (AdWords API Team)]

Hi Noah,

You need to look at your clientCustomerId, and the login for which you generated your OAuth2 tokens. Does the login that the OAuth2 belongs to have access to this customerId? (i.e. it is a login to this customerId, or an MCC that has access to this customerId)

Cheers,

Anash P. Oommen,
AdWords API Advisor.

[Noah Silverman]

Anash,

I used an MCC account (of which the customer is not a member) for generating the OAuth2 tokens.

The "client_customer_id" is the ID of MY MCC account.  Is that incorrect?

In general, we want to develop a service where we can access the accounts of many clients programmatically.  I've seen other adwords optimization services to this, so there must be an easy way.  (They generally just have a link to "allow API access" that the customer clicks.)  

Thanks!

--
--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
http://adwordsapi.blogspot.com
http://groups.google.com/group/adwords-api
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
 
You received this message because you are subscribed to the Google
Groups "AdWords API Forum" group.
To post to this group, send email to adwor...@googlegroups.com
To unsubscribe from this group, send email to
adwords-api...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
 
---
You received this message because you are subscribed to a topic in the Google Groups "AdWords API Forum" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/adwords-api/-tSoqtE6ll4/unsubscribe?hl=en.
To unsubscribe from this group and all its topics, send an email to adwords-api...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Anash P. Oommen (AdWords API Team)]

Hi Noah,

client_customer_id is the customer id of the account for which you are making calls. E.g. if you are retrieving campaigns, the OAuth2 token could belong to either the Advertiser account or a parent MCC, the client_customer_id should be that of the Advertiser account.

Cheers,
Anash