Service Account Authentication Issue

[Lee Franke]

C#  .Net Framework 4.8

I was told to use a service account otherwise I would be using OAuth2/ClientSecret/Id/etc

I'm using the same Service Account to successfully extract data from AnalyticsDataService

Right now my code is very simple just trying to get it to authenticate and return some data.

            var googleAdsConfig = new GoogleAdsConfig
            {
                DeveloperToken = "vcvcxvvxvxxcvxvxxc",
                OAuth2Mode = OAuth2Flow.SERVICE_ACCOUNT,
                OAuth2SecretsJsonPath = credentialsFilePath,
                OAuth2Scope = "https://www.googleapis.com/auth/adwords",
                OAuth2PrnEmail = "star*********serviceaccount.com"
            };

            var googleAdsClient = new GoogleAdsClient(googleAdsConfig);

            // Get the Google Ads service
            var googleAdsService =   googleAdsClient.GetService(Services.V17.GoogleAdsService);

            // Replace with your desired query
            var query = @"
                SELECT
                    campaign.name,
                    ad_group.status
                FROM campaign
                WHERE campaign.status IN (ENABLED, PAUSED)
            ";

            // Execute the search request
            var searchStreamResponse =  googleAdsService.SearchStream("NNNNNN", query,
                    delegate (SearchGoogleAdsStreamResponse resp)
                    {
                        foreach (GoogleAdsRow googleAdsRow in resp.Results)
                        {
                            Console.WriteLine("Campaign with ID {0} and name '{1}' was found.",
                                googleAdsRow.Campaign.Id, googleAdsRow.Campaign.Name);
                        }
                    }
                );

I get the error 

Status(StatusCode="Unauthenticated", Detail="Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project."

thanks for your help,

lee

[Google Ads API Forum Advisor]

Hi,

Thank you for reaching out to the Google Ads API support team.

Based on the provided information, I understand that you are getting the error "UNAUTHENTICATED" when trying to perform the search stream. I would suggest checking your API configuration by referring to this Make an API call documentation especially the authentication part as the issue is occurring when there is an issue related to this. Also, could you please confirm if you already followed the Troubleshooting: Ensuring connectivity ? In addition to the Google Ads API perspective, you may also attempt to make this request using the OAuth Playground. As with the OAuth Playground, you can verify your credentials and request headers, if it is indeed valid or connected to the MCC account.

Please provide us with the complete API logs (request and response logs with request-id and request header) generated at your end and uncropped UI screenshot of the Google Ads account where you are facing the issue.

If you are using a client library and haven't enabled the logging yet, I would request you to enable logging for the specific client library that you are using. You can refer to the guides Java, .Net, PHP, Python, Ruby or Perl to enable logging at your end. For REST interface requests, you can enable logging via the curl command by using the -i flag.

You can send the details via Reply privately to the author option, or direct private reply to this email.
 

This message is in relation to case "ref:!00D1U01174p.!5004Q02tJXlh:ref" (ADR-00244920)

Thanks,
 

Google Ads API Team

Register for the upcoming workshop: Performance Max and the Google Ads API!
 

[Lee Franke]

Turning on logging got the error data I needed. It was as I expected:

 "The Google account (@gmail.com user) that generated the OAuth access tokens is not associated with any Ads accounts. Create a new account, or add the Google account to an existing Ads account."

Reading it literally indicates that the person who created the Service Account does not have permission to the Ads Account. Or does is it the Service Account does not have the permissions to the Ads account?

thanks,

lee

[Lee Franke]

Fixed that issue. I'm not getting

Detail="failed to connect to all addresses"
"description":"Failed to pick subchannel"

thanks,

[Lee Franke]

&#)$#$)$ Well the connection issue was a work VPN issue. 

back to the same error NOT_ADS_USER.

I'll see if they can fix whatever is the issue.

thanks,

lee

[Google Ads API Forum Advisor]

Hi,

Could you confirm if you have followed these Prerequisites and Service account access setup guides in order to avoid issues with using the service account on your end? If you are the domain administrator, complete the help center instructions. Since the service account doesn't have a real email address, you won't be able to accept the invitation in the traditional way.

I strongly recommend using OAuth2 desktop app or web app flow instead of service accounts unless you need a domain-specific feature (for example, impersonation). Also, I would like to inform you that Google Cloud Platform project with an OAuth consent screen to a publishing status of 'In production' will obtain a refresh token that will not expire every 7 days.

Hope this helps. If you have any more queries, please feel free to get back to us.