REST headers

[Muhammad Fikri Mohd Saman]

Let's say for example I created a manager account so that I can get a developer token to be able to use Google Ads API. I have another developer in my team that also want to test out the API, so naturally he created a test manager account with some test clients.

Using the my developer token, he tried to execute a query but was met with the following error 

{
  code: 403,
  message: 'The caller does not have permission',
  status: 'PERMISSION_DENIED',
  details: [
    {
      'type': 'type.googleapis.com/google.ads.googleads.v14.errors.GoogleAdsFailure',
      errors: [Array],
      requestId: '5cY1RukspatkjaJZnyMrvQ'
    }
  ]
}

Is it not possible to use a centralized developer token or are we not doing it right? Should the login-customer-id correspond to the manager providing the developer token?

[Google Ads API Forum Advisor]

Hi,

Thanks for reaching out to Google Ads API Forum.

With regards to your concern, I can see that you are encountering the PERMISSION_DENIED error. This error means that the authorized customer does not have access to the operating customer. The common cause for this error is when authenticating as a user with access to a manager account but not specifying login-customer-id in the request. Thus, I would recommend you to specify the login-customer-id as the manager account ID without hyphens (-). 

Additionally, kindly note that the developer token is like a license key, it is tied to an MCC account for approval purposes. Once approved, you can use it to make calls against any Google Ads account. The MCC hierarchy for making API calls doesn't matter. However, this is not the case on your end since the Test Manager account does not contain a developer token. Thus, adding the login-customer-id as the manager account ID will resolve this issue.

If the issue still persists, then you may provide us with the user account or email address that you used to generate API access or refresh tokens so that we can further check if you set the correct customer ID to login-customer-id.

You may then send the requested information via the Reply privately to the author option. If this option is not available, you may send the details directly to our googleadsa...@google.com alias instead.

Links included in this email:

• Google Ads API - https://developers.google.com/google-ads/api/docs/start 
• PERMISSION_DENIED - https://developers.google.com/google-ads/api/docs/best-practices/common-errors#authorizationerror 
• Login-customer-id -https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid

 

This message is in relation to case "ref:_00D1U1174p._5004Q2mrs0i:ref"

Thanks,
 

Google Ads API Team

 

[Muhammad Fikri Mohd Saman]

So if I understand this correctly, the developer token is only valid for the test manager accounts that I created. Other developers in my team cannot use that developer token. So they have to create their own separate manager account to get a developer token. But if my developer token got approved, it can be used by other developers, right? If that's the case, what do you mean by "getting approved"? Do you mean when I successfully get apply either for Basic Access or Standard Access?

[Google Ads API Forum Advisor]

Hi Muhammad,

Thank you for your quick response.

Moving forward to your concerns:

• But if my developer token got approved, it can be used by other developers, right?

• • Yes. You’ll need only to authenticate API requests with OAuth2 credentials (https://developers.google.com/google-ads/api/docs/oauth/cloud-project) using the email with the appropriate access(https://support.google.com/google-ads/answer/9978556?visit_id=637631240193711507-751960742&rd=1) to the accounts (customer_id) you will specify in your requests.

• If that's the case, what do you mean by "getting approved"? Do you mean when I successfully get apply either for Basic Access or Standard Access?

• • Yes. This means getting approved on your application for Basic or Standard Access.