Data Manager API Setup
Setup Authentication
Refer to Set up API access
for more details.
1. Enable the API
Prerequisites: A Google Cloud project, the Google Cloud CLI (gcloud), and
a Google Account with a project role that can enable APIs, such as Owner,
Editor, or Service Usage Admin. Always tell the user about the required
role. If gcloud isn't installed, prompt the user to install it first.
gcloud services enable datamanager.googleapis.com --project={project_id}
gcloud services list --enabled --project=PROJECT_ID --filter="datamanager.googleapis.com"
2. Generate Application Default Credentials (ADC)
Choose the method that matches the user's scenario:
-
User account (API calls are made as the user's own Google Account): The
Data Manager API scopes are sensitive, so the user must first configure
their project's Google Auth Platform:
-
Data Access page: Add the Data Manager API scopes.
-
Audience page: Set Publishing status to Testing. Use the
Internal user type for a Google Workspace organization, or
External with the user's account added as a Test user.
-
Create (or reuse) a Desktop app OAuth client and download its JSON
configuration file.
-
The user runs the following command, which opens a browser login:
gcloud auth application-default login \
--scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform" \
--client-id-file="{client_id_file_path}"
Unverified app screen: This warning appears because the Data Manager API
scopes are sensitive. During Testing, External test users still see it
and can continue past it. Before other users can sign in, the app must
complete
OAuth app verification.
Service accounts don't need verification.
-
Service account (API calls are made as an app identity instead of a
person): For local development, use service account impersonation rather
than a service account key, since keys are a security risk if not managed
carefully.
-
Grant the Service Account the Service Usage Consumer IAM role
(roles/serviceusage.serviceUsageConsumer) on the project.
-
Grant the user executing gcloud the Token Creator role
(roles/iam.serviceAccountTokenCreator) on that Service Account.
-
Run:
gcloud auth application-default login \
--impersonate-service-account={service_account_email} \
--scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform"
-
Data partner creating partner links in advertiser accounts: Read
Partner Links.
Multiple APIs: To use the same credentials for other APIs, append their
scopes to the --scopes list in the commands above (e.g.,
https://www.googleapis.com/auth/adwords for the Google Ads API or
https://www.googleapis.com/auth/display-video for the Display & Video 360
API).
Verify: gcloud auth application-default print-access-token prints an
access token when credentials are set up correctly.
Troubleshooting PERMISSION_DENIED with a valid token: Add the user or
service account to the destination account (for example, the Google Ads account
or its manager account). For service accounts, also confirm the
Service Usage Consumer role on the Cloud project.
Production: For production authentication (workloads in or outside Google
Cloud, apps that act on behalf of other users, or partner links), see
Deploy to production.
Install Client & Utility Libraries
Refer to Install a client library
for more details.
The companion utility libraries provide pre-built helper classes
and functions to correctly format, hash, and encrypt user identifiers (such as
emails, phone numbers, and physical addresses) prior to API ingestion. Use of
these libraries is highly recommended to ensure that user identifier formatting
matches the API's specifications.
Select the language-specific installation guide below: