Re: User doesn't have permission to access customer - what am I missing?

[Rob Sharp]

Hey Mark,

Thanks for your response. Your description of the variables helped me a 
lot. I had the mental model backwards.

I replaced *login-customer-id* with the oauth token UID, and the download 
runs as expected.

Thanks for your help!

On Tuesday, February 23, 2021 at 1:28:51 PM UTC+11 adsapiforumadvisor wrote:

> Hi Rob,
>
> Thanks for raising this to us.
>
> Given the error string (User doesn't have permission to access customer) 
> provided, I can see that you've encountered the USER_PERMISSION_DENIED 
> 
>  error 
> which signifies that the authorized customer does not have access to the 
> operating customer. That said, could you confirm if the OAuth2 credentials 
> being used was generated from a user’s email address that has an access to 
> the *login-customer-id* found in your API request header? Also, could you 
> confirm if the *login-customer-id *is correct (as the manager account ID 
> without hyphens)? If indeed the user has right access credentials to the 
> *login-customer-id*, could you provide us the details below (via *Reply 
> privately to author* option) so our team can further investigate?
>
>- Complete request 
>
> 
> and response 
>
> 
> (with request-id 
>
> 
>) logs 
>- Email Address used to authenticate the API call 
>- Customer ID of the authenticated user 
>
> As an aside, since you're using the Ruby version of the client library, 
> could you try following the configuration guide as mentioned here 
> 
> ?
>
> Regards,
> [image: Google Logo] 
> Mark Kevin Albios 
> Google Ads API Team 
>   
>
> ref:_00D1U1174p._5004Q2CThqf:ref
>

-- 
-- 
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwords-api@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscr...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
--- 
You received this message because you are subscribed to the Google Groups 
"AdWords API and Google Ads API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to adwords-api+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/adwords-api/e33d51d8-bd83-4cb2-a220-2a2f2dab2661n%40googlegroups.com.

RE: User doesn't have permission to access customer - what am I missing?

[Google Ads API Forum Advisor Prod]

Hi Rob,

Thanks for raising this to us.

Given the error string (User doesn't have permission to access customer) 
provided, I can see that you've encountered the USER_PERMISSION_DENIED error 
which signifies that the authorized customer does not have access to the 
operating customer. That said, could you confirm if the OAuth2 credentials 
being used was generated from a user’s email address that has an access to the 
login-customer-id found in your API request header? Also, could you confirm if 
the login-customer-id is correct (as the manager account ID without hyphens)? 
If indeed the user has right access credentials to the login-customer-id, could 
you provide us the details below (via Reply privately to author option) so our 
team can further investigate?

Complete request and response (with request-id) logs
Email Address used to authenticate the API call
Customer ID of the authenticated user

As an aside, since you're using the Ruby version of the client library, could 
you try following the configuration guide as mentioned here?

Regards,

Mark Kevin Albios
Google Ads API Team
ref:_00D1U1174p._5004Q2CThqf:ref

-- 
-- 
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwords-api@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscr...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
--- 
You received this message because you are subscribed to the Google Groups 
"AdWords API and Google Ads API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to adwords-api+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/adwords-api/07Q9h0QOYMVN00PMIx5wuqRN2YKF1MVNbszw%40sfdc.net.

User doesn't have permission to access customer - what am I missing?

[Rob Sharp]

Hi,

I'm downloading customer data using a customer OAuth token.

I'm seeing the following error:

Google::Ads::GoogleAds::Errors::GoogleAdsError(Google::Ads::GoogleAds::Errors::GoogleAdsError):
 
User doesn't have permission to access customer. Note: If you're accessing 
a client customer, the manager's customer id must be set in the 
'login-customer-id' header. See 
https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid

My token structure looks like this (Ruby))

client = Google::Ads::GoogleAds::GoogleAdsClient.new do |config|
  config.client_id = ENV.fetch('GOOGLE_CONSUMER_KEY')
  config.client_secret = ENV.fetch('GOOGLE_CONSUMER_SECRET')
  config.developer_token = ENV.fetch('GOOGLE_DEVELOPER_TOKEN')
  config.refresh_token = token['refresh_token'] # customers oauth refresh 
token
  config.logger = Logger.new(STDOUT)
  config.login_customer_id = token['manager_id'] # managers (mcc) ID
end

customer_id = token['uid'] # customers oauth uid

ga_service = client.service.google_ads

responses = ga_service.search_stream(
  :customer_id => customer_id,
  :query => <<~QUERY
 
As far as I can tell, the manager_id has the customer_id as a child. The 
oauth token is valid, and the login_customer_id header is being supplied.

What have I missed to make this run correctly?

Thanks,

 -- Rob

-- 
-- 
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwords-api@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscr...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
--- 
You received this message because you are subscribed to the Google Groups 
"AdWords API and Google Ads API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to adwords-api+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/adwords-api/c68c76ae-20b4-414b-aa50-e926afe26a45n%40googlegroups.com.