PERMISSION_DENIED while trying to make a call to the API

[Pedro Donini]

Hi,

My goal is to be able to extract spending information from all my company's campagins with Python. I have done the following:
- Requested a developer token on our Google Ads MCC production account and also got the basic access level for it
- Created OAuth 2.0 Client IDs on console.cloud.google.com/apis/credentials for the same email that I use to log into the MCC account on Google Ads (enabling Adwords API)
- Generated a refresh token using the OAuth id and secret from above
- Created the .yaml file with indicating these variables: 
client_id,  client_secret,  refresh_token -> from the OAuth client ID I generated
developer_token -> from the MCC account on Google Ads
login_customer_id -> the MCC account ID
customer_id -> the client account ID where we have all campaigns
use_proto_plus -> True

On my script, I load credentials with:
client = GoogleAdsClient.load_from_storage(version="v14")

I check the accesible accounts with list_accessible_customers(), which returns me the id of our customer account.

But when I try to run a search_stream(), I get this error:
Request with ID "QImrcICidFADHfM64eT40w" failed with status "PERMISSION_DENIED" and includes the following errors:
        Error with message "User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid".

What am I doing wrong?
Kind regards,
Pedro

[Google Ads API and AdWords API Forum]

Re-posting the last inquiry (https://groups.google.com/g/adwords-api/c/mV2BfjQ8gog) from the forum as it wasn't routed to our support queue.

Regards,
Google Ads API Team

[Google Ads API and AdWords API Forum]

Hi Pedro,

Thank you for raising this issue to the Google Ads API support team.

Regarding your concern, it appears that you've encountered the USER_PERMISSION_DENIED error which occurs when the authorized customer does not have access to the operating customer. This is an authorization error (https://developers.google.com/google-ads/api/docs/best-practices/common-errors#authorizationerror) which its common cause is when authenticating as a user with access to a manager account but not specifying login-customer-id in the request. It also occurs when the OAuth2 credentials (https://developers.google.com/google-ads/api/docs/oauth/cloud-project) you are using were generated by a user / email address that does not have access (https://support.google.com/google-ads/answer/9978556?visit_id=638028230738600037-122357065&rd=1) to the account (customer_id) specified in your request. You can manage user access by referring to this article (https://support.google.com/google-ads/answer/6372672).

If the issue persists even after doing the above details, you may send us the below complete API logs generated on your end and the user / email address that you used in your authentication process for further investigation.

• request - https://developers.google.com/google-ads/api/docs/concepts/field-service#request
• response - https://developers.google.com/google-ads/api/docs/concepts/field-service#response
• request ID - https://developers.google.com/google-ads/api/docs/concepts/call-structure#request-id
• request header - https://developers.google.com/google-ads/api/docs/concepts/call-structure#request_headers

You may then send the requested logs via the Reply privately to author option. If this option is not available, you may send the details directly to our googleadsa...@google.com alias instead.

Regards,
Google Ads API Team

On Thursday, August 10, 2023 at 12:58:34 AM UTC+8 pdo...@rauva.com wrote: