RE: 401 error

[Google Ads API Forum Advisor]

Hi Prasad,

 

I'm Kevin from the Google Ads API Team.

 

Could you please confirm if you’ve indeed followed every step of the service account guide, specifically the prerequisites? If your service account has been correctly configured, please provide the complete request and response logs with request ID where you have encountered an error as well as the the user account/email address that you're trying to setup so I can better investigate your concern.

 

You may refer to our logging guide for the Java client library for instructions on how to enable it on your end. You may then send the requested information via the Reply privately to author option. If this option is not available, you may send the details directly to the googleadsa...@google.com alias instead.

 

Regards,

Kevin Gil Soriano Google Ads API Team

ref:_00D1U1174p._5004Q2TLsaJ:ref

[prasad mokkapati]

I was reading about domain wide delegation to fix the issue I am seeing since I read that someone else had similar issue and were able to use jwt and domain wide delegation - https://developers.google.com/identity/protocols/oauth2/service-account#jwt-auth

https://developers.google.com/admin-sdk/directory/v1/guides/delegation

If that is the case, what would be the auth scopes/domain wide delegation be for Google Ads ?

[prasad mokkapati]

Hi Kevin,

I had sent an email earlier related to this issue, got a response back, but that was not helpful in fixing the issue. I was not sure how I can reply back to the sender that the solution suggested did not work.  We are able to can connect up but getting the following errors when we make queries from test account. Replace CustomerID to XXX in the call below

query: "SELECT campaign.id, campaign.name FROM campaign ORDER BY campaign.id"GoogleAdsServiceImpl.getCampaigns 444 Obtained stream[warn] c.g.a.g.l.r.summary - FAILURE REQUEST SUMMARY. Method: google.ads.googleads.v9.services.GoogleAdsService/SearchStream, Endpoint: googleads.googleapis.com:443, CustomerID:XXXX , RequestID: null, ResponseCode: UNAVAILABLE, Fault: Credentials failed to obtain metadata.

Can you please let me know if I need to make sure that the following steps are needed so we can get around these issues in test account. Or are there some other initial settings need to be done to make "test" calls from test accounts. 

• Basic access - https://services.google.com/fb/forms/newtoken
• Domain wide delegation access

We searched all the documents we can find related to test accounts - the steps we need to follow but don't seem to  able to get the right answers/go around these issues.

We tried both - REST interface as well as Java interface for service connectivity (no OAuth approval from end user).

https://developers.google.com/google-ads/api/rest/overview
https://developers.google.com/google-ads/api/docs/client-libs

Thank you

On Thursday, December 16, 2021 at 8:38:04 PM UTC-8 adsapi wrote:

[Google Ads API Forum Advisor]

Hi Prasad,

I am also a member of Google Ads API Support. 

I had to delete your initial and last post as the logs contained your developer token and GCP project id. Since your developer token was exposed, we recommend that you reset the token by referring to this guide. For privacy purposes, you may avoid exposing your developer token and other sensitive data publicly. Please continue our discussion privately via the Reply privately to author option or direct support to our googleadsa...@google.com alias.

Moving forward, could you please confirm if you’ve indeed followed every step of the guide, specifically the prerequisites?  In order to connect to Google Ads API using a Google service account, you will need a Google Workspace domain since it is a prerequisite for using service accounts. Note that Google Ads does not support using service accounts without impersonation. Because user impersonation is controlled only at the domain level, using service accounts and assertion flow with Google OAuth2 requires you to have your own domain registered with Google Workspace. Your application and its users will have the ability to impersonate any user in the domain.

However, kindly note that, we strongly recommend using OAuth2 installed app or web flows instead of service accounts unless you need domain-specific features (for example, impersonation). OAuth2 installed application and web flows require user interaction only once, when access to the account is granted. This process of authentication is much simpler to set up via OAuth2 credentials. You need to implement the code set up on your end to make calls using service accounts. 

Regards,

Yasar Google Ads API Team

ref:_00D1U1174p._5004Q2TLsaJ:ref

[prasad mokkapati]

Hi,

I followed every step. We do have a google workspace domain "lifewisedigital.com". I am able to connect up but have issues doing queries from test account. I would assume if we are able to connect up we should be able to do queries as well from test account.

GoogleAdsServiceImpl.getCampaigns 222 googleAdsServiceClient:com.google.ads.googleads.v9.services.GoogleAdsServiceClient@XXXX

GoogleAdsServiceImpl.getCampaigns 333 request:customer_id: "XXXXX"

query: "SELECT campaign.id, campaign.name FROM campaign ORDER BY campaign.id"

GoogleAdsServiceImpl.getCampaigns 444 Obtained stream

[warn] c.g.a.g.l.r.summary - FAILURE REQUEST SUMMARY. Method: google.ads.googleads.v9.services.GoogleAdsService/SearchStream, Endpoint: googleads.googleapis.com:443, CustomerID: XXXXX, RequestID: null, ResponseCode: UNAVAILABLE, Fault: Credentials failed to obtain metadata.

~                                

[prasad mokkapati]

Hi,

We cannot use use web flow/OAuth since calls come from our backend, not from a web site. We provide a service to our clients where merchants sign up to our platform and we we make calls from multiple merchants/clients for Ads which we then use our backend to submit to Google Ads.

[Google Ads API Forum Advisor]

Hi Prasad,

Please only respond to use privately, as this topic requires us to refer to email addresses, which are not allowed to be posted publicly on the forum.

I noticed that the serviceAccountUser in your ads.properties file does not have access to the account specified in the login-customer-id field in your request. Please provide this user access and see if this works. Please let us know what the outcome of this by responding privately. 

Regards,
Matt
Google Ads API Team


Reminder: Share your feedback about the Google Ads (AdWords) API! Take the 2021 Google Ads API and AdWords API Annual Survey
 

Matt Google Ads API Team

ref:_00D1U1174p._5004Q2TLsaJ:ref