Google Ads - Service Account Unauthenticated

[Jeeva Bharathy]

Hi Team,

I am using Google Ads API using python library to connect my 'Test' Google Ads Account.

I have following parameters in my yaml file,

developer_token : my Production Google Ads Account Developer Token

use_proto_plus: True

client_id : my service account 'Unique ID'

json_key_file_path : my service account configuration file location

impersonated_email : my service account email address, like XXXXiam.gserviceaccount.com

After i configured above , i am trying like 

python GoogleAd.py -c <test-account-id>

but am getting below error message,

Request made: ClientCustomerId:  <test-account-id>  , Host: googleads.googleapis.com, Method: /google.ads.googleads.v11.services.GoogleAdsService/SearchStream, RequestId: k9qZb7moOaQXYd5C62dT4Q, IsFault: True, FaultMessage: User in the cookie is not a valid Ads user.
Request with ID "k9qZb7moOaQXYd5C62dT4Q" failed with status "UNAUTHENTICATED" and includes the following errors:
        Error with message "User in the cookie is not a valid Ads user."

I have validated email address used to create service account is same as my PRODUCTION google ads login account.

Can you please guide me , how to fix this issue.

Thanks

S.Jeeva 

[Google Ads API Forum Advisor]

Hi Jeeva,

Thank you for reaching us out. I am Sherwin from Google Ads API support team. I hope that you are doing well today.

I can see that you have received the NOT_ADS_USER error when you attempted to connect to the API. The NOT_ADS_USER error is encountered when the service account has not been correctly linked to the Google Ads account via the OAuth2 assertion flow. Please take note that the email address you may have used to generate the credentials should have access or be associated with Google Ads accounts. 

In order to connect to Google Ads API using a Google service account, you will need a Google Workspace domain since it is a prerequisite for using service accounts. Since you mentioned that you’re using service account credentials, please confirm if you already followed all the mentioned requirements:

1. The service account that you created needs to be granted domain wide delegation access by a super administrator for the domain.
2. Using a Google Ads user with permissions on the Google Ads account you want to access. 
3. Make sure that you have your own domain registered with Google Workspace.
4. Service account will have the ability to impersonate any user in the domain

You may refer to this API documentation that discusses how to access the Google Ads API with service accounts. 

In addition, kindly note that, we strongly recommend using OAuth2 installed app or web flows instead of service accounts unless you need domain-specific features (for example, impersonation). OAuth2 installed application and web flows require user interaction only once, when access to the account is granted. You need to implement the code set up on your end to make calls using service accounts. 

Kind regards,

Sherwin Vincent Google Ads API Team

ref:_00D1U1174p._5004Q2ey7aG:ref

[Jeeva Bharathy]

Hi  Sherwin,

I have corrected my 'impersonated_email' parameter and now I am getting a new  error as below,

[2022-10-06 19:17:31 - WARNING] Request made: ClientCustomerId: 9662991256, Host: googleads.googleapis.com, Method: /google.ads.googleads.v11.services.GoogleAdsService/SearchStream, RequestId: RuvaWWWNXlLg4JdS24ekrg, IsFault: True, FaultMessage: User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid
Request with ID "RuvaWWWNXlLg4JdS24ekrg" failed with status "PERMISSION_DENIED" and includes the following errors:
        Error with message "User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid"

Can you please help me to fix this issue.

[Google Ads API Forum Advisor]

Hi Jeeva,

Thank you for the reply.

I understand that you are encountering the "PERMISSION_DENIED error", which means a user doesn't have permission to access a customer and you’re accessing a client customer using 'login-customer-id’ in the request.

To address the above error, you will need to ensure that the user / email address you used to generate the credentials indeed has access to the account in your request. If the user / email address has access or is associated with the MCC / manager account, you will need to specify the said MCC / manager account ID as the value of the login-customer-id field.

If the issue still persists, can you please provide the user account / email address that you used to generate API access or refresh tokens? With the help of this information, I can check if you set the correct customer ID to login-customer-id.

You may then send the requested information via the Reply privately to author option.

Best regards,

Heidi Google Ads API Team

ref:_00D1U1174p._5004Q2ey7aG:ref