Client is unauthorized using ServiceAccount

[Pedro Javier Martin Doimeadios]

Hi, I have a ServiceAccount which I want to use, to get authenticated in my Python Script, so I can execute requests to the Google Ads API. But I have a problem when authenticating with ServiceAccount

I use the provided credentials.json and put following configuration properties in my dicctionary:
dict_to_auth = {
            "json_key_file_path": auth_file,
        "impersonated_email": impersonated_email,
        "developer_token": developer_token,
        "version": 'v16',
        "use_proto_plus": False,
        }

• impersonated_email: user from google ads with permissions to admin (not the client_email from ServiceAccount)
• developer_token: developer token from account google ads
• json_key_file_path (credentials .json) path with service account with format json
• use_proto_plus: False

I use following code to instantiate the client:
googleads_client = GoogleAdsClient.load_from_dict(config_dict=dict_to_auth, version="v16")

I expect that the client recognizes, that I'd like to authenticate with the provided ServiceAccount details, but I just get following response:
('unauthorized_client: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.', {'error': 'unauthorized_client', 'error_description': 'Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.'})

I have created the service account with permissions for the Google Ads API, as indicated in the docs, and follow the prerequisites in the guide, but when I try to connect with the email of the user who has access in Google Ads, it returns the previously mentioned error. But if I write the client_email of the Account service, it generates the client, but when I make a query it returns the following error: "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. Message: The Google account (@gmail.com user) that generated the OAuth access tokens is not associated with any Ads accounts. Create a new account, or add the Google account to an existing Ads account".

So I would like the next questions to understand the flow:

• What settings should I have in Google Ads?
• I should have in Google Ads, if the creation of the ServiceAccount
• Should have a relationship with a google ads user
• Should the impersonated_email should be that of a google ads user, or what permissions it should have if It's like that?

If it is necessary to attach more details, I look forward to hearing from you.