Missing Required Authentication

[Mario Anes]

Hi,

I'm trying to connect and pull data from Google Ads API, however, I keep getting error message saying "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project."

I have tried these steps:

1. Using the playground https://developers.google.com/google-ads/api/docs/oauth/playground

2. Using client library

3. Using curl/Postman

I have client id, cilent secret, refresh token.  Using method #1 and #3, I'm able to get access token as well.  However, when sending request using the access token (and including developer token), I still get the error message.

Wondering if anyone has ideas on what to try next.

Thank you

Mario

[Mario Anes]

I discovered that my connection works with AdWords but not with Ads API.  Is there a separate sign up for Ads API?

Thank you

[Google Ads API Forum Advisor Prod]

Hi Mario,

Thank you for reaching out to us. I see that you're having trouble connecting to the API using your credentials. Could you provide me with your request and response logs for where you encounter this error linking to the API so that I can further investigate this concern? For privacy, you can reply using "reply privately to the author".

Thank you,
Bryan, Google Ads API Team

ref:_00D1U1174p._5004Q22ZQeA:ref

[Mario Anes]

Hi Bryan,

Thanks for your reply.  It doesn't seem that I have permission to use the reply privately to author, even after setting gmail as the handler for mailto.  I followed the instruction here, https://support.google.com/a/users/answer/9308783?hl=en, set my Windows setting for default mail application as chrome, and restarted my computer.  Is there another set of instruction I should follow to have the permission?

In the meantime, I'm using the c# library and here's the response header when I use the TraceUtilities class.  It doesn't seem to contain sensitive info:

Response

--------

Headers: {

  "request-id": "PdWDMfaB85bFxnmfvZKX1w",

  "date": "Wed, 29 Jul 2020 14:51:49 GMT",

  "alt-svc": "h3-29=\":443\"; ma=2592000,h3-27=\":443\"; ma=2592000,h3-T050=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"",

  "google.ads.googleads.v4.errors.googleadsfailure-bin": "CiwKA4gBAhIlQXV0aGVudGljYXRpb24gb2YgdGhlIHJlcXVlc3QgZmFpbGVkLg==",

  "grpc-status-details-bin": "CBAS1wFSZXF1ZXN0IGlzIG1pc3NpbmcgcmVxdWlyZWQgYXV0aGVudGljYXRpb24gY3JlZGVudGlhbC4gRXhwZWN0ZWQgT0F1dGggMiBhY2Nlc3MgdG9rZW4sIGxvZ2luIGNvb2tpZSBvciBvdGhlciB2YWxpZCBhdXRoZW50aWNhdGlvbiBjcmVkZW50aWFsLiBTZWUgaHR0cHM6Ly9kZXZlbG9wZXJzLmdvb2dsZS5jb20vaWRlbnRpdHkvc2lnbi1pbi93ZWIvZGV2Y29uc29sZS1wcm9qZWN0Lhp1CkN0eXBlLmdvb2dsZWFwaXMuY29tL2dvb2dsZS5hZHMuZ29vZ2xlYWRzLnY0LmVycm9ycy5Hb29nbGVBZHNGYWlsdXJlEi4KLAoDiAECEiVBdXRoZW50aWNhdGlvbiBvZiB0aGUgcmVxdWVzdCBmYWlsZWQu"

}

Fault: {

  "StatusCode": 16,

  "Details": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",

  "RequestId": "PdWDMfaB85bFxnmfvZKX1w",

  "Failure": {

    "errors": [

      {

        "errorCode": {

          "authenticationError": "AUTHENTICATION_ERROR"

        },

        "message": "Authentication of the request failed."

      }

    ]

  }

}

Best,

Mario

[Google Ads API Forum Advisor Prod]

Hi Mario,

Thank you for the update with the logs. I took a closer look at this issue and it looks like you're missing your client credentials. Have you followed these steps to create your client credentials, and have you put them in the properties file that holds your developer token, refresh token, and client credentials? Could you check that you have set your client credentials and try the call again?

[Mario Anes]

Hi,

Just to confirm, I'm looking to access the Google Ads API, instead of AdWords API.  But since from what I understand the authentication is the same, yes, I have followed the steps to create client credentials (https://developers.google.com/google-ads/api/docs/first-call/oauth-cloud-project).  I have tried putting them both in properties file, and set them manually in code.  Using client id and client secret I get a refresh token.  Then using the dev token, refresh token, client id, and client secret in the program to make API call.

Best,

Mario

[Google Ads API Forum Advisor Prod]

Hi Mario,

Thank you for the update. Were you able to perform the call successfully?

[Mario Anes]

Hi,

Unfortunately, still haven't.  I tried just a few minutes ago using the oauth playground.   These are the steps:

1. I followed the instruction here: https://developers.google.com/google-ads/api/docs/oauth/playground

2. Then I use the searchStream query on the last section of this page: https://developers.google.com/google-ads/api/docs/rest/common/search

This is the request:

POST /v4/customers/5287347420/googleAds:searchStream HTTP/1.1
Host: googleads.googleapis.com
Developer-token: (removed)
Content-length: 193
Content-type: application/json
Authorization: Bearer (removed)
{
    "query": "SELECT ad_group_criterion.keyword.text, ad_group_criterion.status FROM ad_group_criterion WHERE ad_group_criterion.type = 'KEYWORD' AND ad_group_criterion.status = 'ENABLED'"
}

This is the response:

HTTP/1.1 401 Unauthorized

Content-length: 653

X-xss-protection: 0

X-content-type-options: nosniff

Transfer-encoding: chunked

Request-id: L_p_e7V2HwauFB2TGytHnA

Vary: Origin, X-Origin, Referer

Server: ESF

-content-encoding: gzip

Cache-control: private

Date: Fri, 31 Jul 2020 13:42:29 GMT

X-frame-options: SAMEORIGIN

Alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Content-type: application/json; charset=UTF-8

[

  {

    "error": {

      "status": "UNAUTHENTICATED", 

      "message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.", 

      "code": 401, 

      "details": [

        {

          "errors": [

            {

              "errorCode": {

                "authenticationError": "AUTHENTICATION_ERROR"

              }, 

              "message": "Authentication of the request failed."

            }

          ], 

          "@type": "type.googleapis.com/google.ads.googleads.v4.errors.GoogleAdsFailure"

        }

      ]

    }

  }

]

Best,

Mario

[Google Ads API Forum Advisor Prod]

Hi Mario,

So it looks like you've gotten your client ID and client Secret and refresh token from the playground successfully. Could you confirm if you've put the client ID and client Secret into the API call? It looks like your code isn't reading the client ID and client Secret from your properties file (java) or yaml file (python). Could you confirm which client library you're using?

[Mario Anes]

Hi, 

Yes, I put the client id and secret into the API call.  The OAuthPlayground won't allow the call (buttons are greyed out) without the client id and secret put into the settings.  For this request, I didn't use any client library.  I use the oauthplayground website to make the API call: https://developers.google.com/oauthplayground/

Best,

Mario

[Google Ads API Forum Advisor Prod]

Hi Mario,

I'll take a look at this internally with my team and get back to you as soon as possible.

[Google Ads API Forum Advisor Prod]

Hello Mario,

I take a look at issues when they get really odd; what you're experiencing is definitely surprising. I ready something that you said earlier, and I want to make sure there isn't a misunderstanding. You said:

• Then using the dev token, refresh token, client id, and client secret in the program to make API call.

Do you pass the refresh token straight into the request, or do you use the access token to make the request? You need to use the refresh token to get an access token. The refresh token doesn't go into the actual query request, the access token does.

Thanks,
Nadine Wang, Google Ads API Team

ref:_00D1U1174p._5004Q22ZQeA:ref

[Mario Anes]

Hi Nadine,

Thanks for looking into this.  So throughout the past week, I've tried different ways to make the API call.  For that particular statement, I was using the .net client library.  With the library, I don't use the access token directly.  The library only requires dev token, refresh token, client id and client secret.  I believe the library should be managing access token.

With the most recent attempt, the one that I sent the response reply a couple of messages ago, I use the oauthplayground, https://developers.google.com/oauthplayground/.  With this attempt, the Web UI takes care of getting the access token on Step 2, when I click on the "Exchange authorization code for tokens" button.

Best,

Mario

[Google Ads API Forum Advisor Prod]

Hello Mario,

I sent a private message to your email address on this thread. Please tell me if you did not see it.

Thanks,
Nadine, Google Ads API Team

ref:_00D1U1174p._5004Q22ZQeA:ref

[Mario Anes]

Thanks Nadine.  I replied to the private message.  Please let me know if you do not get the message.

Best,

Mario