Service account authentication issues

[Jakob Erdmann]

Hello,

we're in the process of integrating Google Ads API into our backend services to manage some conversion related settings.

Since this is an automated integration and doesn't require user interaction authentication should happen via service user.

Now documentation suggests that in order to use a service user for the Google Ads API we need to enable domain-wide delegation for that user which means that it can impersonate any actual user and get their permission level on related google ads accounts. Since also lower level developers have to work with the system and we don't want to give them admin access to our google ads account this is not an option, as all they would need is any admins email address which is easily guessable.

Is there a way to directly link a service account to an Google Ads account and manage permissions directly for that service account?

Thanks,

Jakob

[Google Ads API Forum Advisor]

Hi Jakob,

 

I'm Kevin from the Google Ads API Team. I'll my best to answer your question.

 

As stated in our documentation, Google Ads does not support using service accounts without impersonation. I'm afraid that there's no way to manage permissions for a service account in Google Ads.

 

Let me know if you have any further clarification.

 

Regards,

Kevin Gil Soriano Google Ads API Team

ref:_00D1U1174p._5004Q2QHcgu:ref

[Jakob Erdmann]

Well ... that's really bad. For pure backend services there is no other way then using service accounts and this poses a major security risk.
Are there any plan on improving on this? Maybe allow service accounts to be invited as users to a google ads account so that they can be managed similarly to normal user accounts?

[Google Ads API Forum Advisor]

Hi Jakob,

Thanks for your feedback. Please allow me to share this with our team and see if there are any other options we can provide.

Regards,
Matt
Google Ads API Team


Reminder: Share your feedback about the Google Ads (AdWords) API! Take the 2021 Google Ads API and AdWords API Annual Survey
 

Matt Google Ads API Team

ref:_00D1U1174p._5004Q2QHcgu:ref

[Google Ads API Forum Advisor]

Hi Jakob,

Would it be possible for your application to use either of the Desktop or Web App OAuth strategies instead of Service Accounts? Although they require human intervention, you should only need to intervene once to create a refresh token, which can then be used to generate access tokens automatically without human intervention. I think this would be preferable to using a Service Account, which we normally only recommend when someone needs to use impersonation.

If you have any questions about setting that up let me know.

Best,
Ben, Google Ads API Team

ref:_00D1U1174p._5004Q2QHcgu:ref