Hi,
First, does your application needs impersonation?
If all you want to do is having access to client accounts under an MCC,
then how about using other authentication (installed application or web
flow)?
Either way, once you store a refresh token, there'll be no human
interactions like service accounts.
That makes it much simpler.
Best,
- Takeshi,
On Tuesday, August 13, 2013 4:35:03 AM UTC+9, sfein...@rmn.com wrote:
>
> I'm using the v201306 API, trying to succeed at auth and call AdWords APIs.
>
> We've created a service account and I downloaded the private key. I'm
> attempting to create a credential via:
>
> GoogleCredential credential = new
> GoogleCredential.Builder().setTransport(HTTP_TRANSPORT)
> .setJsonFactory(JSON_FACTORY)
> .setServiceAccountId("xxxxx...@developer.gserviceaccount.com <javascript:>
> ")
> .setServiceAccountScopes(Collections.singleton("
> https://adwords.google.com/api/adwords";))
> .setServiceAccountPrivateKeyFromP12File(new
> File("C:\\downloads\\rmnadwords\\xxxxxxxxxxxxxxxxxxxx-privatekey.p12"))
> .setServiceAccountUser("m...@x.com")
> .build();
>
> On calling credential.refreshToken(), I get an "access_denied" response.
> I do *NOT* get the error response if I do not attempt to impersonate the
> MCC account (i.e. removing the setServiceAccountUser line)...however, then
> upon calling an AdWords API such as to get campaigns I receive the SOAP
> fault "NOT_ADS_USER" response.
>
> We did follow the "Steps to granting a service account impersonation
> abilities" from
> https://developers.google.com/adwords/api/docs/guides/service-accounts.
> However this did not seem to work. I have two questions / theories and am
> open to any other suggestion to getting this interaction working via a
> service account:
>
>
> 1. Is it a problem that our MCC account has one domain...let's call it
> X....for legacy reasons, but the domain has changed to Y and so we manage
> it via https://www.google.com/a/cpanel/Y/ManageOauthClients? In
> AdWords, do we need to create a new user linked to the MCC account, but
> with the Y domain, and impersonate it in the API code rather than the MCC
> account directly?
> 2. Does the service account email address (
> xxxx...@developer.gserviceaccount.com <javascript:> in the code above)
> need to be invited to and linked with the MCC account through the AdWords
> console?
>
> Thanks for any assistance.
>
> This e-mail, including attachments, contains confidential and/or
> proprietary information, and may be used only by the person or entity to
> which it is addressed. The reader is hereby notified that any
> dissemination, distribution or copying of this e-mail is prohibited. If you
> have received this e-mail in error, please notify the sender by replying to
> this message and delete this e-mail immediately.
--
--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
http://adwordsapi.blogspot.com
http://groups.google.com/group/adwords-api
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
You received this message because you are subscribed to the Google
Groups "AdWords API Forum" group.
To post to this group, send email to adwords-api@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscr...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---
You received this message because you are subscribed to the Google Groups
"AdWords API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to adwords-api+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
