Subject: Feasibility and Security Concerns of Google AdManager API Access Using Service Accounts

[Matias Vega]

Hello,

I'm exploring the possibility of allowing different service accounts to access different networks in Google AdManager via a cloud-hosted service.

Currently, our web application facilitates access to this hosted service by storing regular user credentials (username & access token), which are then shared with the hosted service to access Google AdManager networks.

GAM documentation recommends using service accounts for API access, so I'd like to transition from username & access tokens to service account credentials for session generation.

The primary requirement for this change is the ability to use different service accounts dynamically: Users would provide key files on the web application, which would then be sent to the hosted service to access the respective Google AdManager networks. Additionally, I aim to eliminate the use of personal accounts for Google AdManager network access.

Please help in understanding how this could generate security risks and if this approach for accessing GAM is feasible under GAM’s recommendations.

Thanks.

[Ad Manager API Forum Advisor]

Hi,

Thank you for reaching out to the Ad Manager API support team.

I understand that you want to transition from username & access tokens to service account credentials for session generation. I can confirm that this approach is feasible. To use different service accounts dynamically, it requires using different service accounts based on user-provided key files dynamically. Kindly note that transmitting user-provided key files introduces risks of credential leakage or unauthorized use. I would recommend that you use a secure key exchange mechanism to avoid misuse of your credentials.
 

This message is in relation to case "ref:!00D1U01174p.!5004Q02vGzWt:ref" (ADR-00286592)

Thanks,
 

Ad Manager API Team

Feedback
How was our support today?