Hi Cory, Thanks for the update - glad to hear that my recommendation worked for you.
Your assessment of the docs is spot on -- there were some changes in the Google Developers Console recently, and we're a bit behind on syncing up our guides. We plan to take care of that in the near future. Thanks again, Josh, AdWords API Team On Tuesday, August 25, 2015 at 10:11:30 AM UTC-4, Cory Shaw wrote: > > Hi Josh, > > I followed your advice and used the offline flow from the OAuth guide > <https://developers.google.com/adwords/api/docs/guides/authentication> to > obtain a refresh token for the user. I added that token to the config with > the new OAuth2 client credentials (not service account), and it worked like > a charm. I will note that in the guide it was talking about an "Installed > Application", but I believe it should be more apparent for all the client > types to be named "Installed Application". There is Web Application like it > is stated in the documentation, but the rest were not marked as installed > applications. I ended up trying the "Other" type, and that seemed to work. > I used the example project to retrieve a Refresh Token, and used that with > my new OAuth2 client credentials in my project. > > Thanks again! > > On Monday, August 24, 2015 at 4:03:01 PM UTC-4, Josh Radcliff (AdWords API > Team) wrote: >> >> Hi, >> >> It may be that your old Google Apps Domain was a Free edition (legacy) >> <https://support.google.com/a/answer/2855120?hl=en> domain, which is why >> the new domain with a similar setup will not work without upgrading. >> >> However, you can achieve your goal of having read-only access for your >> application as follows: >> >> 1. Create a new Google user (or use an existing user who does not >> currently have access to any AdWords or MCC accounts) and add that user >> as >> a *Read only* user to your MCC. >> 2. Using the *offline* flow described in the OAuth guide >> <https://developers.google.com/adwords/api/docs/guides/authentication> to >> obtain a refresh token for the user from step 1. >> 3. Use the refresh token to obtain access tokens within your >> application. The token will have read-only access, the same as the user. >> >> Is that a feasible alternative for you? >> >> Thanks, >> Josh, AdWords API Team >> >> On Monday, August 24, 2015 at 9:25:58 AM UTC-4, Cory Shaw wrote: >>> >>> We've had no problems with our previous service account for about 1 year >>> now. It still works fine, and we never had to add any AdWords scope to >>> anything. It even worked locally without any issues which isn't a Google >>> App. And yes we need the service account, because managers of the AdWords >>> MCC account are giving access to employees through our app and not letting >>> them sign in to AdWords directly with their email. It's all just read-only >>> reports, we aren't allowing them to create/modify anything through the API. >>> >>> On Monday, August 24, 2015 at 8:59:00 AM UTC-4, Josh Radcliff (AdWords >>> API Team) wrote: >>>> >>>> Hi, >>>> >>>> I'm not aware of any recent changes to service account requirements -- >>>> they have always required a Google Apps Domain as far back as I recall. >>>> >>>> Coming at this from a different angle, do you actually need service >>>> account functionality, or could you simply use *offline* access as >>>> described in the alternative to service accounts section of the guide >>>> <https://developers.google.com/adwords/api/docs/guides/service-accounts#alt> >>>> ? >>>> >>>> Thanks, >>>> Josh, AdWords API Team >>>> >>>> On Monday, August 24, 2015 at 8:41:37 AM UTC-4, Cory Shaw wrote: >>>>> >>>>> The only way to use the API now with a service account is using a >>>>> Google Apps domain paying for Google Apps users per month? It wasn't like >>>>> that before. Plus how would this work with localhost and testing >>>>> purposes? We don't need any of what Google Apps has to offer. We just >>>>> want >>>>> API access like before. >>>>> >>>>> On Friday, August 21, 2015 at 5:13:01 PM UTC-4, Josh Radcliff (AdWords >>>>> API Team) wrote: >>>>>> >>>>>> Hi, >>>>>> >>>>>> Did you also complete the Steps to granting a service account >>>>>> impersonation abilities >>>>>> <https://developers.google.com/adwords/api/docs/guides/service-accounts#impersonation>, >>>>>> >>>>>> using the new client ID? >>>>>> >>>>>> Thanks, >>>>>> Josh, AdWords API Team >>>>>> >>>>>> On Thursday, August 20, 2015 at 4:11:04 PM UTC-4, Cory Shaw wrote: >>>>>>> >>>>>>> We recently had to switch to a new manager account for AdWords due >>>>>>> to the domain of the email associated with the account. We have an >>>>>>> in-house >>>>>>> dashboard for our clients to sign in and visually see reports returned >>>>>>> from >>>>>>> the AdWords API. On our previous MCC account we were accepted to the >>>>>>> API >>>>>>> and had a working Developer Token and service account with .p12 key >>>>>>> that >>>>>>> successfully connects to the API. To fix our domain issue, we created a >>>>>>> new >>>>>>> MCC account that fit our domain problems. We then made our new MCC >>>>>>> account >>>>>>> a manager of our old MCC account, and then continued to add the rest of >>>>>>> our >>>>>>> clients to the new MCC account. >>>>>>> >>>>>>> After doing so we needed to fix our dashboard to use the new MCC's >>>>>>> developer token and service account credentials. So we signed into the >>>>>>> same >>>>>>> email as our new MCC account and went to the Developer's Console and >>>>>>> created a new service account. The same as we made our old MCC's >>>>>>> service >>>>>>> account. We switched our dashboard to use the new service account's >>>>>>> credentials, p12 key, and Developer Token, then switched the Prn Email >>>>>>> to >>>>>>> match. Unfortunately, it is returning: >>>>>>> >>>>>>> { >>>>>>> >>>>>>> "Failed to get access token for service account. >>>>>>> >>>>>>> { >>>>>>> >>>>>>> "error" : "unauthorized_client", >>>>>>> >>>>>>> "error_description" : "Unauthorized client or scope in >>>>>>>> request." >>>>>>> >>>>>>> } >>>>>>> >>>>>>> } >>>>>>> >>>>>>> >>>>>>> Our old Service Account worked immediately after we created it, but >>>>>>> this is giving us trouble if we try to connect at all. Our settings are >>>>>>> identical except for the credentials shown below: >>>>>>> >>>>>>> >>>>>>> //OLD MCC >>>>>>> >>>>>>> ((AdWordsAppConfig) _user.Config).DeveloperToken = >>>>>>> "OLD_MCC_TOKEN"; >>>>>>> >>>>>>> ((AdWordsAppConfig) _user.Config).OAuth2ClientId = " >>>>>>> OLDapps.googleusercontent.com"; >>>>>>> >>>>>>> ((AdWordsAppConfig) >>>>>>> _user.Config).OAuth2ServiceAccountEmail = " >>>>>>> o...@developer.gserviceaccount.com"; >>>>>>> >>>>>>> ((AdWordsAppConfig) _user.Config).OAuth2PrnEmail = " >>>>>>> o...@gmail.com"; >>>>>>> >>>>>>> ((AdWordsAppConfig) _user.Config).OAuth2CertificatePath >>>>>>> = AppDomain.CurrentDomain.GetData("DataDirectory") + "/OLD.p12"; >>>>>>> >>>>>>> >>>>>>> //NEW MCC >>>>>>> >>>>>>> ((AdWordsAppConfig) _user.Config).DeveloperToken = >>>>>>> "NEW_MCC_TOKEN"; >>>>>>> >>>>>>> ((AdWordsAppConfig) _user.Config).OAuth2ClientId = " >>>>>>> NEW.apps.googleusercontent.com"; >>>>>>> >>>>>>> ((AdWordsAppConfig) >>>>>>> _user.Config).OAuth2ServiceAccountEmail = " >>>>>>> n...@developer.gserviceaccount.com"; >>>>>>> >>>>>>> ((AdWordsAppConfig) _user.Config).OAuth2PrnEmail = " >>>>>>> n...@gmail.com"; >>>>>>> ((AdWordsAppConfig) _user.Config).OAuth2CertificatePath >>>>>>> = AppDomain.CurrentDomain.GetData("DataDirectory") + "/NEW.p12"; >>>>>>> >>>>>>> I made the New MCC's developer console IDENTICAL to the old MCC's >>>>>>> developer console, and still no luck. I checked to make sure the new >>>>>>> .p12 >>>>>>> file exists and it does. I'm stumped. >>>>>>> >>>>>>> Any help would be greatly appreciated! >>>>>>> >>>>>> -- -- =~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ Also find us on our blog and Google+: https://googleadsdeveloper.blogspot.com/ https://plus.google.com/+GoogleAdsDevelopers/posts =~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ You received this message because you are subscribed to the Google Groups "AdWords API Forum" group. To post to this group, send email to adwords-api@googlegroups.com To unsubscribe from this group, send email to adwords-api+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/adwords-api?hl=en --- You received this message because you are subscribed to the Google Groups "AdWords API Forum" group. To unsubscribe from this group and stop receiving emails from it, send an email to adwords-api+unsubscr...@googlegroups.com. Visit this group at http://groups.google.com/group/adwords-api. To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/62d9ee9c-210f-4085-b9bf-a041e96e44aa%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
