Google Ads API - "failed with status "PERMISSION_DENIED" - "User doesn't have permission to access customer."

Question

I am trying to work with Google-ads-API. Running Ubuntu 20.04, Python 3.9(min requirement for the client library to work is 3.6), working with google-ads-api V6. Here's the story of my agony.

I have made a test manager account[A], generated a developer's token, and have "test-level" access to use the API, which is great. Test level allows you to make calls to the API regarding information\reports dealing with test accounts(not production).

Also, went through the whole Oauth2 credentials for account [A], allowed test emails, and after running "examples/authentication/authenticate_in_web_application.py", I am redirected to a webpage, allow my main test manager account to access the second test manager account[B](as instructed by the documentation, to create another test manager account[B], besides the main account[A] with the developer token), a refresh token is generated successfully from this OAuth2 prompt, to allow account [B] to be managed my account [A], added the refresh token to my google-ads.yaml file, and things are all good.

When I run this .py file from the examples

python3 google-ads-python/examples/account_management/list_accessible_customers.py

The result is this:

Total results: 2
Customer resource name: "customers/1792845307"
Customer resource name: "customers/5341438919"

Lovely, took 2 days to get this far. And it's been two days now trying to get past the following. Please note that the above results are both from my account [B], the API request to get these results was made while the developer token for account [A] is set in the google-ads.yaml file.

So, the .yaml file for now contains Developer account token for account [A], OAuth creds for account[A] on cloud console(.json) file. The refresh token for account [B] that resulted from the Authentication in step1.

Moving on, by running "get_account_information.py", which is also in the examples folder, and passing to it one of the accounts from the above result[mandatory flag --c, which is the client id), I keep getting an access denied error:

python3 get_account_information.py --c 5341438919 I get this:

Request with ID "LhKeU9ZI4zZgnp05VSHbjg" failed with status "PERMISSION_DENIED" and includes the following errors:
Error with message "User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid".```

I have tried setting "the manager's customer id must be set in the 'login-customer-id' ", this login-customer-id is located in the .yaml file. I have tried setting that to both the results from the call in step 2. I also tried adding the account manager ID from account[A]. I tried manually adding account [A] as an account manager for account [B] from withing google-ads's UI, then tried setting the "login-customer-id" again for all these accounts these linking processes, yet, failed miserably.

I am facing this access denied for all the .py files in the example directory. Tried to be as thorough and verbose as possible for this lengthy process, hoping it'll make sense. If you have tried to work with this API, you will understand what I mean, and I look forward to any insight\help\input regarding this, even if you haven't worked with this API.

In the documentation, the guide says that after creating a test developer manager account, all accounts below that will be also test accounts, and will be designated by a red label saying "TEST", otherwise it's a production account. Both accounts [A]+[B] above are test manager\developer accounts, yet don't have any red labels stating they are tests, neither any children I tried creating under them. So I wonder if the error\roadblock I am facing is due to them not being designated as test accounts? But why are they being listed as "Accessible accounts" in Step2.

Thanks a lot! If any other pieces of info should be required, I shall provide.

Answer 1

--------------SOLVED--------------

An update, just a few hours later. I made another new manager account, using the same email used in manager account[B] mentioned in the question. Followed the same steps as mentioned above, but this time after creation, I got this "RED TEST ACCOUNT FLAG".

I run this in terminal, for the 678th time after roughly a hundred previous attempts:

u@ROOT:~/google-ads-python$ python examples/account_management/list_accessible_customers.py

[2021-01-12 11:30:08 - INFO] Request made: ClientCustomerId: None, Host: googleads.googleapis.com:443, Method: /google.ads.googleads.v6.services.CustomerService/ListAccessibleCustomers, RequestId: XIkvfX4b-xxNql705r_jbQ, IsFault: False, FaultMessage: None
Total results: 3
Customer resource name: "customers/1792845307"
Customer resource name: "customers/5341438919"
Customer resource name: "customers/3740041699"

So, the new account which is actually recognized as a test is "3740041699". Take note of this number, it'su sed in the google-ads.yaml file. Added it under "login_customer_id: " there, because it's a "manager account"[B], that manages a child account I made under it. with the number of 991738295.

My .YAML looks like this

# OAuth2 configuration
###############################################################################
# The below configuration parameters are used to authenticate using the       #
# recommended OAuth2 flow. For more information on authenticating with OAuth2 #
# see: https://developers.google.com/google-ads/api/docs/oauth/overview       #
###############################################################################

    developer_token: ******** #[ from Account A]
    client_id: ******.apps.googleusercontent.com #[From account A's email, that was used in google cloud console for API OAuth2]
    login_customer_id: 3740041699 [The manager test account B, mentioned above]
    client_secret: ******** #[From account A's email, that was used in google cloud console for API OAuth2]
    refresh_token: 1//********* [After authenticating account A to have access to account B]

Now when running the cherry on top, we have this:

u@ROOT:~/examples/basic_operations/get_campaigns.py -c 9917382925 #ID of child of test manager mentioned above, this is the result: 

Campaign with ID 12058644642 and name "Website traffic-Search-1" was found.
[2021-01-12 11:36:39 - INFO] Request made: ClientCustomerId: 9917382925, Host: googleads.googleapis.com:443, Method: /google.ads.googleads.v6.services.GoogleAdsService/SearchStream, RequestId: Py4oeSqyYiQpBFIWuRYgEg, IsFault: False, FaultMessage: None

Which is exactly what is there, as demonstrated in this picture:

Finally after 5 days. Now that it's working, an actually start developing. I would appreciate if anybody is using the python client, and finds this useful, to advise to any best practices regarding server and routing or things they learned while developing with this interesting API.

THANKS! Have a great day.