Impossible to use service account without google workspace

[Richard Mayes]

Hi,

So for a few days, I've been trying to get a service account set up so that we can administer our ads in a windows service without user intervention. It turns out that this is impossible. 

If we try and use the service account without impersonation we get this exception:

[ { "errorCode": { "authenticationError": "NOT_ADS_USER" }, "message": "User in the cookie is not a valid Ads user." } ]

I tried adding the generated email address of the service account as a normal user inside the "Access and security" section of google ads but that "invites" the user and they just sit in "Pending invitations" and obviously there is no real email behind that service account to accept the invitation. It is also impossible as an admin to promote that invitation to an active account and we end up getting the same error above. 

If I try and impersonate the google account that set up the Google Adwords/Ads account I then get this error:

Error:"unauthorized_client", Description:"Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested." 

To fix you need to enable the delegation to the domain but this is impossible as the domain needs to be sitting under a google workspace which we don't have and why should we have to when already pay significant fees for the ads themselves?

Is there any solution to this?

Thanks 

Richard

[Google Ads API Forum Advisor]

Hi Richard,

Thank you for reaching out to the Google Ads API support team.

The NOT_ADS_USER error usually occurs when the login used to generate the access token is not associated with any Google Ads account.

Make sure to log in with a valid Google Ads account (typically your manager account) for the OAuth flow.Could you please confirm if you’ve indeed followed every step of the guide, specifically the prerequisites?  If your service account has been correctly configured, please provide the complete request and response logs with request ID where you have encountered an error as well as the user account/email address that you're trying to set up so I can better investigate your concern. Please reply via privately author option.

However, kindly note that we strongly recommend using OAuth2 installed app or web flows instead of service accounts unless you need domain-specific features (for example, impersonation). OAuth2 installed application and web flows require user interaction only once, when access to the account is granted. You need to implement the code set up on your end to make calls using service accounts.


Thanks,

Nirmitabahen Gaurav Google Ads API Team

 

ref:_00D1U1174p._5004Q2cE28f:ref