Google Ads Developer Blog: authentication

Google Ads API Introducing New Error Codes for Invalid Developer Tokens Starting April 28, 2025

2025 m. kovo 31 d., pirmadienis

Previously, if any Google Ads API request had an invalid developer token, the API returned an OAUTH_TOKEN_HEADER_INVALID error, which is also used for other invalid request header values. To make it clear when the authentication error is specifically caused by an invalid developer token, we are changing the API to return a new error code, DEVELOPER_TOKEN_INVALID, for version v19.1 of the Google Ads API. All API versions before v19 will handle invalid developer tokens by throwing a DEVELOPER_TOKEN_NOT_APPROVED error instead. If you are using version v19 of the API with our client libraries, you will need to update to the latest version of the client libraries after the v19.1 release. These changes will be effective starting April 28, 2025. Anyone who has already set up the Google Ads API to make successful calls are highly unlikely to be affected by this change. It is mainly meant to improve the experience of new developers onboarding to the API. If you have any questions, please ask them in the Google Ads API forum. We're here to help!

- Dora Sun - Google Ads API Team

Upcoming changes to CustomerService in Google Ads API

2025 m. vasario 27 d., ketvirtadienis

CustomerService.CreateCustomerClientGoogle Ads APIMarch 17, 2025New error codes for policy enforcement

Google Ads manager accounts that do not have a certain threshold of spending or a certain number of active child accounts without policy issues (for example, not suspended or closed for policy violations) will be ineligible to create child accounts under them. Developers will receive a CustomerError.CREATION_DENIED_INELIGIBLE_MCC error code in the upcoming version v19 of the Google Ads API. To fix the issue, link a Google Ads account that is compliant with the Google policies and meets the threshold spending levels under your manager account.

Google Ads manager accounts that have been flagged for policy violations related to account creation will no longer be able to create child accounts under them. Developers will receive a CustomerError.CREATION_DENIED_FOR_POLICY_VIOLATION error code in the upcoming version v19 of the Google Ads API.

ContextError.OPERATION_NOT_PERMITTED_FOR_CONTEXTQuota limits for account creationQuotaError.RESOURCE_EXHAUSTEDretry_delayquota_error_detailsWhat do I need to do?support pageGoogle Ads product support team

- Anash P. Oommen, Google Ads API Team

Consent unbundling in Ads APIs

2025 m. vasario 20 d., ketvirtadienis

What’s changing?May 1 2025BackgroundFigure 1Figure 2Who is affected by this change?

Your API application uses a Google Cloud Console project that was created before 2019.

Your application implements the OAuth 2.0 user consent flow – an authentication workflow where the user logs in with their Google account and grants one or more permissions that your application is requesting.

Your application uses more than one Google API, and one of the APIs is an Ads-related API listed below.

Who isn’t affected by this change?

Existing refresh tokens: This change doesn’t affect user authentications that you already have in place. Your existing refresh tokens will continue to work without any changes or re-authentication.

Single scope applications: If your application uses only one Google API scope, your application isn’t affected by this change, since there aren’t multiple OAuth scope to unbundle.

Single user applications / Manually authenticated applications: Your application doesn’t have an explicit OAuth user authentication flow implemented. Instead, you use a manual authentication script such as GenerateUserCredentials, gcloud CLI or OAuth Playground to authenticate the user, and then use those credentials for a long period of time. Since you select all the scopes that your application requires while authenticating, your application isn’t affected by this change.

Service accounts: If your application uses a service account to authenticate your API calls, you won’t be affected by this change

What do I need to do?

Request the list of OAuth scopes that the user consented to by including the include_granted_scopes parameter in your OAuth flow.

Examine the actual list of OAuth scopes that the user consented in the OAuth response.

Implement incremental authorization in your application.

granular consent guideHow do I test this feature?

Create a new Google Cloud project: New Google Cloud projects have enabled OAuth consent unbundling. So you can create a new Google Cloud project, and use it for testing your application.

Enable consent unbundling in your existing project: You can set the enable_granular_consent parameter to true in your OAuth authorization request.

Which API scopes are affected?

API

OAuth Scope

Google Ads API

https://adwords.google.com/api/adwords

Google Ad Manager API (SOAP API, Beta)

https://www.googleapis.com/auth/dfp
https://www.googleapis.com/auth/admanager

Bid Manager API

https://www.googleapis.com/auth/doubleclickbidmanager

Content API for Shopping

https://www.googleapis.com/auth/content

Display and Video 360 API

https://www.googleapis.com/auth/display-video-mediaplanning
https://www.googleapis.com/auth/display-video-user-management

AdMob API

https://www.googleapis.com/auth/admob.report
https://www.googleapis.com/auth/admob.googlebidding.readwrite
https://www.googleapis.com/auth/admob.monetization

AdSense for Platforms API

https://www.googleapis.com/auth/adsensehost
https://www.googleapis.com/auth/adsense
https://www.googleapis.com/auth/adsense.readonly

Google Analytics API

https://www.googleapis.com/auth/analytics
https://www.googleapis.com/auth/analytics.readonly
https://www.googleapis.com/auth/analytics.edit
https://www.googleapis.com/auth/analytics.manage.users
https://www.googleapis.com/auth/analytics.manage.users.readonly
https://www.googleapis.com/auth/analytics.provision
https://www.googleapis.com/auth/analytics.user.deletion

Campaign Manager 360 API

https://www.googleapis.com/auth/ddmconversions
https://www.googleapis.com/auth/dfareporting
https://www.googleapis.com/auth/dfatrafficking

Search Ads 360 API

https://www.googleapis.com/auth/doubleclicksearch

Google Tag Manager API

https://www.googleapis.com/auth/tagmanager.delete.containers
https://www.googleapis.com/auth/tagmanager.edit.containers
https://www.googleapis.com/auth/tagmanager.edit.containerversions
https://www.googleapis.com/auth/tagmanager.manage.accounts
https://www.googleapis.com/auth/tagmanager.manage.users
https://www.googleapis.com/auth/tagmanager.publish
https://www.googleapis.com/auth/tagmanager.readonly

Real time bidding API

https://www.googleapis.com/auth/realtime-bidding

Authorized Buyers Marketplace API

https://www.googleapis.com/auth/authorized-buyers-marketplace
https://www.googleapis.com/auth/adexchange.buyer

How to get help

- Anash P. Oommen, Google Ads API Team

Improved support for service accounts in the Google Ads API

2024 m. lapkričio 27 d., trečiadienis

Google Ads has rolled out a new feature that allows Google Ads account administrators to grant access to a service account. Once the access has been granted, you can use the service account credentials to make API calls to that Google Ads account and other accounts in that hierarchy, if applicable. Refer to the service account guide to learn more about this option. This new approach simplifies the Google Ads API authentication process in two important ways:

If your application works entirely offline without any user interaction, then you no longer need to generate a refresh token. This means you can also avoid other steps such as configuring an OAuth consent screen and performing OAuth App verification.

The new service account flow doesn’t require you to be a Google Workspace user or configure the service account for domain-wide impersonation.

We hope this simplifies your experience when working with the Google Ads API. How to get help If you have any questions or need help, check out the Google Ads API support page for options.