How to resolve manager accounts throwing the USER_PERMISSION_DENIED error

[praj...@gmail.com]

We have a manager account with google adwords which throws the following error AuthenticationError.USER_PERMISSION_DENIED. 

As per documentation given on the adwords page link https://developers.google.com/adwords/api/docs/common-errors#AuthorizationError.USER_PERMISSION_DENIED 

we are unable to figure out the solution that has to be taken in order to rectify the account.

Is re-authorizing the client secret key or resetting the developer token right option to address this exception?

If none of the above are the the viable solutions then let us know if any alternate way to resolve this issue.

[Sreelakshmi Sasidharan (AdWords API Team)]

Hi, 

The error AuthenticationError.USER_PERMISSION_DENIED occurs when there is no link between the manager account that you are authenticating as and the client account that you are trying to make the request against. Please make sure that the accounts are linked and try again.

You need not reset the developer token. But if you are unsure about the OAuth credentials,  I would suggest to regenerate the credentials from the level you have access to and would like to target.

Thanks,

Sreelakshmi, AdWords API Team

[ccy...@gmail.com]

Hi Sreelakshmi,

We are trying to use the CustomerService to retrieve the accounts for a credential.  For some credentials, we are getting CUSTOMER_NOT_FOUND.  Can you verify what this means?

In some cases, we are getting more than 1 account returned.  Does this make sense?  Should we only be getting back the master account?  Also, if we want to get a valid list of accounts for a credential, do we need to then use the ManagedCustomerService?  If so, how is this done?  I don't see a link between those 2 services.

Is there any other reason we would get the USER_PERMISSION_DENIED error?

Thank you.

-Chris

[Sreelakshmi Sasidharan (AdWords API Team)]

Hi Chris, 

The CUSTOMER_NOT_FOUND error means either the customer Id being passed is incorrect or the account was just created by the ManagedCustomerService. It will take a few minutes before the newly created account using ManagedCustomerService is accessible. If the account was not created with in few minutes of making the request, please double check the customer id for its correctness. 

Our documentation about CustomerService and ManagedCustomerService should be helpful for you. Customerservice.getcustomers() will return the details of all the customers directly accessible by the user authenticating the call.

In your case, you could probably use the CustomerService.getCustomers() method to get a list of all accounts that has access using the OAuth credentials. This service should give you the clientCustomerId of the account you are authenticated as. ManagedCustomerService can be used to get the account hierarchy for the give clientCustomerId. Please check our example on ManagedCustomerService to get the account hierarchy.

If you are still facing issues, could you please share the SOAP logs (request/response)? 

[praj...@gmail.com]

Hi Sreelakshmi,

Using ManagedCustomerService we were able to determine the accounts that have failed with USER_PERMISSION_DENIED error.

According to your API support - https://developers.google.com/adwords/api/docs/common-errors#AuthorizationError.USER_PERMISSION_DENIED

there are 2 common causes - 

• The link between the manager and client account was removed.
• Your OAuth credentials don't match the client ID specified, or any of its manager accounts.

Could you please help us on how to identify which among the two causes is the actual reason for particular account to throw the USER_PERMISSION_DENIED error.

Thanks,

Prajakt

[Sreelakshmi Sasidharan (AdWords API Team)]

Hi Prajakt,

To check if the manager and client account is linked, please log onto your Manager account, click the Accounts label and check if the client account is listed. If not listed, that could be reason of the error.

If you are not sure about the OAuth credentials, you could regenerate them by making sure that you are authenticating as the same user/email for generating the refresh token as that of the login of the AdWords account.

[SOHAIR AHMAD]

I had the same issue, resolved finally, not sure why this happen and what is the difference between Manager Id and Leaf account id; but I resolved by doing this.

Check the customer client ID of your user, 

Check if this match with your adwords account manager id (the account with which you are logged in ?)

If yes, then you need to change your customer client ID to be the same for Leaf account, Note that Manager Account ID does not work, Why ? I do not know yet.

Attaching screenshot so that you know where In menu you can find these IDs

this is the account ID that should match with your customer client id

this is the manager account ID that might be OR some other account id is in the field of your customer client id 

[Sreelakshmi Sasidharan (AdWords API Team)]

Hi, 

For a client account, using the OAuth credentials and refresh token which was generated while logged into the email/user login corresponding to the client account and using the customer id of that account will work.

If the credentials of an MCC account is being used, it should still work if the client account is linked to it. Please note that the client accounts are different from MCC accounts and you will not be able to create a campaign while using the credentials of the manager accounts.

Thanks

Sreelakshmi, AdWords API Team

[ccy...@gmail.com]

Sreelakshmi,

We are not seeing this behavior.  Our customer seems to have created a new credential (a non-MCC account).  When trying to get the list of accounts for this credential, and using the customerId of their client account (xxx-xxx-xxxx) we are unable to get access.  We get back AuthorizationError.USER_PERMISSION_DENIED error.  With our internal testing account, which is an MCC account, we are able to login and return the list of linked accounts.  Do you have any ideas why this would happen?  Are there any other permissions/setup that needs to be done?

-Chris

Dev Team Lead, Mediaocean

[Sreelakshmi Sasidharan (AdWords API Team)]

Hi Chris, 

Could you please 'Reply privately to author' and provide me the Customer ID for which USER_PERMISSION_DENIED occurs and the email Id of the account that is being used to generate the OAuth credentials? I am suspecting that the user is not logged into the right account while clicking 'Accept' for the OAuth flow.

This forum post which talks about the same error might be helpful.