Service account and Google Ads Api

[Thijs]

I am trying to connect to the google ads api through an service account. I am able to get the necessary authorization token, but then the api returns a NOT_ADS_USER error. Just to make sure I checked the https://console.cloud.google.com/apis/api/googleads.googleapis.com/credentials?authuser=1&project=*** page. Under credentials compatible with this API the service account I use to generate the authentication token is listed. So at this point I am stuck. Any thought on how to solve this?

Details authentication process and request:

GoogleCredential credential = new GoogleCredential.Builder() 

.setTransport( httpTransport ) 

.setJsonFactory( JSON_FACTORY ) 

.setServiceAccountId( serviceAccountEmail ) 

.setServiceAccountScopes( Collections.singleton("https://www.googleapis.com/auth/adwords" ) )

 .setServiceAccountPrivateKeyFromP12File( pk12Filepk12File ) 

.build(); 

 

credential.refreshToken();

accessToken = credential.getAccessToken();

curl.exe --request POST "https://googleads.googleapis.com/v5/customers/******/googleAds:searchStream" --header "Content-Type: application/json" --header "Authorization: Bearer ******" --header "developer-token: ******" --data "{'query': 'SELECT * FROM campaign WHERE segments.date DURING YESTERDAY'}" 

Json Responds

 [{ "error": { "code": 401, "message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.", "status": "UNAUTHENTICATED", "details": [ { "@type": "type.googleapis.com/google.ads.googleads.v5.errors.GoogleAdsFailure", "errors": [ { "errorCode": { "authenticationError": "NOT_ADS_USER" }, "message": "User in the cookie is not a valid Ads user." } ] } ] } } ] 

 I read a similar post here: https://groups.google.com/g/adwords-api/c/_CEOICa97V8/m/DIhpo44TAwAJ . However no solution was provided.

[Google Ads API Forum Advisor Prod]

Hi,

The NOT_ADS_USER indicates that the email address you may have used to generate the credentials may not have access or associated to any Google Ads accounts.

You may retry and make sure to log in with a valid Google Ads account (typically your manager account) when creating the credentials for your chosen OAuth flow.

Best regards,

Peter Laurence Napa Oliquino Google Ads API Team

ref:_00D1U1174p._5004Q25Z2u8:ref

[Google Ads API Forum Advisor Prod]

Hi Thijs,

I had to delete your previous response and repost it below :

"Hi Peter thanks for replying. 

I checked this and I am using the correct e-mail account address for as far as I can tell. The (service account) e-mail address  I use to generate the access token is listed under credentials compatible with this API (in Google Ads Api). The email address itself looks something like this: "XXXXXX". 

BTW The way I generate the accessToken is exactly the same as I do for accessing the analytics Api which uses the same service account and does work. So I still need some help.

Kind regards 
Thijs"

This is because any form of account related email or information is a potential security risk when exposed publicly.

Moving forward, the @developer.gserviceaccount.com user that you used may not be the correct user to be logged in to when generating your service account credentials.

Could you try and go to the Tools icon > Account access > USERS view of your Google Ads account and login to the Google API console as one of the users listed in the said view? Once in the Google API console, you may retry generating the service account credentials. Should the issue persist, you may provide the user (email address) that you were logged in to so our team can investigate.

Please note that when you send your user or email address, you may use the Reply privately to author option.

[Thijs]

The  Reply privately to author  is disabled, i do not have sufficient rights for some reason. 

Just to make sure. In our Google Ads Manager Account   there is no option Tools icon > Account access > Users.  I can find my user details under SETTINGS & BILLING > ACCOUNT > Access & Security. I use the user listed here to login to the  Google Api Console. I created a new service account just to make sure. I get the exact same error.

Kind regards,

Thijs

Op dinsdag 6 oktober 2020 om 06:10:48 UTC+2 schreef adsapiforumadvisor:

[Thijs]

I also noticed something else. If i change the developerToken or customerId parameter I get the same error. So apparently those are wrong. 

The developer token I got from the Google ads manager account > TOOLS>  API center. Access level for this developer token is "Test account"

The customer Id I got from Google ads manager account > SETTINGS & BILLING > ACCOUNT > Access & Security. The number under the manager account which is formatted as follows: xxx-xxx-xxxx. To connect to https://googleads.googleapis.com/v5/customers/xxxxxx xxxx/googleAds:searchStream the minus symbol is removed from the customer id.

Op dinsdag 6 oktober 2020 om 12:16:31 UTC+2 schreef Thijs:

[Google Ads API Forum Advisor Prod]

Hi Thijs,

The NOT_ADS_USER should point to an issue with user that was logged in while creating the service account. Errors related to the developer token and customerID should return a different error.

Moving forward, could you also confirm if all the prerequisites and the succeeding steps, including this section, were completed correctly when you generated your service account credentials?

If all requirements and steps were followed and you continue to encounter the issue, you may send all the private details such as the complete request and response logs, your customer ID, and the user (email address) that you used to generate your service account, to our support alias (googleadsa...@google.com), so we can discuss in private.

[Eylon Raymond Harari]

I had the exact same problem - NOT_ADS_USER 

If you indeed completed all the prerequisites and the succeeding steps, including this section, and still have the error - 

the problem might be that you are creating the access_token in the wrong way. Try using this code (it's in nodejs but easily applied in all languages) 

const private_key = require('./key.json').private_key;

const token = jwt.sign(

{

iss:

SERVICE_ACCOUNT_EMAIL,

sub: GOOGLE_MMC_MANAGER_EMAIL,

scope: 'https://www.googleapis.com/auth/adwords',

aud: 'https://oauth2.googleapis.com/token',

exp: Math.round(Date.now() / 1000) + 3600,

iat: Math.round(Date.now() / 1000),

},

private_key,

{ algorithm: 'RS256' },

);

// console.log(token);

try {

const response = await http.post('https://oauth2.googleapis.com/token', {

grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',

assertion: token,

});

const access_token = response.data;

console.log(access_token);

} catch (error) {

console.log(error.data);

}

};

// Make an authorized request with the access_token

hope it will help as it helped me