Service Account: NOT_ADS_USER

[VM Suse]

Hi Google team,

I am facing the following issue. I was able to get the data via API using the refresh token which was created manually with OAuth 2.0 Playground. But it is valid just for 7 days. Now I am trying to make it work with service account but seems like I am doing something wrong. I am using google-ads.yaml file where I provide developer_token, json_key_file_path and impersonated_email, which I guess should be (###@###-123456.iam.gserviceaccount.com) and login customer_id.  Here is the error I am getting:

"Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.","grpc_status":16}"
>, errors {
  error_code {
    authentication_error: NOT_ADS_USER
  }
  message: "User in the cookie is not a valid Ads user."
}
request_id: "2m7ydydG--mQc5rNksXw3w"
, '2m7ydydG--mQc5rNksXw3w')

Please assist.

Thanks, 

Vitaly

[Google Ads API and AdWords API Forum]

Re-posting the last inquiry (https://groups.google.com/g/adwords-api/c/HHsFE8oJIQw) from the forum as it wasn't routed to our support queue.

Kind regards,
Sherwin Vincent

Google Ads API Team

[Google Ads API and AdWords API Forum]

Hi Vitaly,

Thank you for posting your concern.

With regard to the NOT_ADS_USER error, this error occurs when login user account / email address used to generate the access token is not associated with any Google Ads account. With this, make sure to log in with a valid Google Ads account (typically your manager account) for the OAuth flow. 

Also, I would recommend using the Desktop app flow (https://developers.google.com/google-ads/api/docs/oauth/client-library) instead and not the service account flow if you can. You can only use it unless you need a domain-specific feature (for example, impersonation). One step being incorrect means that it won't work for service accounts, which appears to be the case here.

However, if you still want to use service account, then make sure you to follow this guide and use your desired client library to lessen the incorrect set up because as I mentioned earlier one incorrect set up and service accounts will not work. 

If the error persists after trying the provided suggestions, then please provide the email address / user account used to set up service account and complete request and response logs with request ID generated on your end to investigate. Please provide the requested details via Reply privately to author option.

Kind regards,
Sherwin VIncent

Google Ads API Team

On Tuesday, July 19, 2022 at 5:18:49 PM UTC+8 vitaly....@suse.com wrote:

[Google Ads API Forum Advisor]

Hi Keang,

This is Carmela from the Google Ads API team as well. Thank you for reaching out. However, I need to delete your recent email in the forum as it contains your logs.
 
Moving forward, I can see that you have received the NOT_ADS_USER error when you attempted to connect to the API. The NOT_ADS_USER error is encountered when the service account has not been correctly linked to the Google Ads account via the OAuth2 assertion flow. Please take note that the email address you may have used to generate the credentials should have access or be associated with Google Ads accounts. 

In order to connect to Google Ads API using a Google service account, you will need a Google Workspace domain since it is a prerequisite for using service accounts. Since you mentioned that you’re using service account credentials, could you confirm if you already followed all the mentioned requirements:

• The service account that you created needs to be granted domain wide delegation access by a super administrator for the domain.
• Using a Google Ads user with permissions on the Google Ads account you want to access. 
• Make sure that you have your own domain registered with Google Workspace.
• Service account will have the ability to impersonate any user in the domain

 
You may refer to this API documentation that discusses how to access the Google Ads API with service accounts. 

In addition, we strongly recommend using OAuth2 installed app or web flows instead of service accounts unless you need domain-specific features (for example, impersonation). OAuth2 installed application and web flows require user interaction only once, when access to the account is granted. You need to implement the code set up on your end to make calls using service accounts.

Regards,

Carmela Google Ads API Team

ref:_00D1U1174p._5004Q2edyiC:ref