Alright, it's becoming more clear now.
Correct me if I am wrong, but here's what I think is going on:
* I created the service account for API use to Google Analytics 4, and
I just added the service account to the authorized users as view-only.
* Google Ads REQUIRES that invitees accept the invitation via email.
This is impossible for a service account, therefore my service account can
not directly access Google Ads
* To bypass this, I must impersonate my personal email with the service
account. Impersonation requires the service account to have Domain Wide
Delegation
Okay, fair enough. I checked and we don't have the admin.google.com account
so that I can set up Domain Wide Delegation.
Unless I am mistaken somehow. But I don't see any indication that we have
such an account.
I take it that I will need to create this admin.google.com account with an
internal email, say goo...@mycompany.com.
But then I assume I must manually add the *main email** and my *personal
email** to this new admin.google.com account, as workforce members or
something?
...and after that, I should be able to see the Service Account I created in
there? Then I can just give it Domain Wide Delegation?
Is this all accurate?
On Wednesday, October 5, 2022 at 1:37:33 PM UTC-7 adsapi wrote:
> Hi Chad,
>
> Thank you for your response and for the additional details.
>
> Before I raise this to the rest of our support team, could you also
> clarify first the below items :
>
> - As per the prerequisites
>
> <https://developers.google.com/google-ads/api/docs/oauth/service-accounts#prerequisites>
>
> section, were you also able to setup a Google Workspace domain
> <https://workspace.google.com/>?
> - In the first *Key point* section of the guide
>
> <https://developers.google.com/google-ads/api/docs/oauth/service-accounts>,
> it then says that "*A service account can only impersonate users
> (email addresses) in the same Google Workspace
> <https://workspace.google.com/>*"
> - Was your personal email then added as a user of the said Google
> Workspace?
> - Lastly, could you confirm if you have also completed the steps 2 and
> 3 of this section
>
> <https://developers.google.com/google-ads/api/docs/oauth/service-accounts#service_account_access_setup>
>
> (see domain wide delegation access guide
> <https://support.google.com/a/answer/162106>)?
>
> In the event that all these other items have been completed, let us know
> so our team can then raise this along with the requestId details you
> earlier provided.
>
> Best regards,
>
> [image: Google Logo]
> Peter Laurence
> Google Ads API Team
>
>
> ref:_00D1U1174p._5004Q2ewsYl:ref
>
--
--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwords-api@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscr...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---
You received this message because you are subscribed to the Google Groups
"Google Ads API and AdWords API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to adwords-api+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/adwords-api/13865cfb-0528-427e-bd3a-0b767d5f8d39n%40googlegroups.com.
