Permission Denied error received in Google Ads API, but not for AdWords API

[Paul Cooper]

Hi,

As we began to integrate parts of the new google ads api into our current solution, we have run into an issue with certain accounts being unable to use the new API (receiving a USER_PERMISSION_DENIED). The accounts with this issue all have a mcc link with a particular mcc, but use their individual oauth credentials to connect to the API. With AdWords, there is no issues.

Other accounts linked to the same mcc, but use the mcc oauth credentials have no permissions. We also have another MCC 'above' the one in question. Accounts using account OR mcc oauth credentials can access the new API fine when linked to this parent MCC.

Any insight, ideas or help with this issue would be greatly appreciated.

Paul

[Google Ads API Forum Advisor Prod]

Hi Paul,

Thanks for reaching out. The error USER_PERMISSION_DENIED usually occurs when there is no link between the manager account authenticated in the request and the client account specified in the headers. If the link between the manager and client account was removed or you don’t have access to the client customer ID specified or any of its manager accounts, you may encounter this error. To resolve this issue, you will need to use the OAuth2 Credentials that were generated using an email address which has access to the account indicated in your request header. If you are using Google Ads API you need to include the login-customer-id in the header as mentioned in this blog post. 

Please let us know if you have any further questions.

Thanks and regards,
Xiaoming, Google Ads API Team

ref:_00D1U1174p._5001UOCwYj:ref

[Paul Cooper]

Hi Xiaoming,

Sorry it wasn't clear but we are currently using both APIs simultaneously as we test and develop for the new API.

The customers from MCC (let's say, ID 123-123-4567) using their account level oauth credentials receive 'USER PERMISSION DENIED' (works fine in the old AdWords API).

Other customer from the same MCC, using MCC level oauth credentials are fine.

Another MCC, which is also the manager of ID 123-123-4567 and our MAIN mcc, has customers that authenticate with account level credentials, and can use the new API. They can also use MCC oauth credentials fine as well.

So there is just a small subset of customer, authenticating in a particular way on a specific MCC that currently have issues with the new API - but can use the old one fine!

Regards,

Paul

[Google Ads API Forum Advisor Prod]

Hi Paul,

When we make an API request it is very important that we make sure there is a link between the manager account authenticated in the request and the client account specified in the headers. Also you have to make sure the OAuth2 credentials that are being used belong to the manager account you are authenticating. Could you please provide your main MCC customer Id and specify the ones that are working and the ones that you encounter issues with? Please reply to us with the above information via the Reply privately to author option.

Thanks and regards,
Xiaoming, Google Ads API Team

ref:_00D1U1174p._5001UOCwYj:ref

[gardella...@gmail.com]

Hi,

I am having the same issue. How did you solve it?

Thanks,

Juan

[gardella...@gmail.com]

Solved. The problem was I was create credentials using the customer id. In order to fix it, I create the credential using the root account id and during queries, I have to choose the login-customer-id. By playing with https://developers.google.com/google-ads/api/docs/migration/login-customer-id was useful. Example:

  static GoogleAdsClient getClient() {
    return GoogleAdsClient.newBuilder().setCredentials(getCredential())//
        .setLoginCustomerId(rootCustomerId)//
        .setDeveloperToken(developerToken).build();
  }

  private static Credentials getCredential() {
    return UserCredentials.newBuilder().setClientId(clientId).setRefreshToken(refreshToken)
        .setClientSecret(clientSecret).build();
  }

And when doing the queries, choose the proper loginCustomerId

    SearchGoogleAdsStreamRequest request = SearchGoogleAdsStreamRequest.newBuilder().setCustomerId(
        Long.toString(loginCustomerId)).setQuery(query).build();

[Google Ads API Forum Advisor]

Hi Juan,

Glad to see your issue has been resolved. You may also find the API call structure guide useful as well.

Regards,
Matt
Google Ads API Team

Matt Google Ads API Team

ref:_00D1U1174p._5001UOCwYj:ref