Set up API access

Page Summary

Accessing the Data Manager API requires a Google Cloud project and a Google Account with the necessary permissions.
The Data Manager API must be explicitly enabled in your Google Cloud project settings.
Authentication for the Data Manager API can be set up using various methods, including user accounts and service accounts, with Application Default Credentials recommended for automatic credential finding.
Setting up access involves configuring Google Auth Platform settings and potentially undergoing Google OAuth verification for user accounts accessing sensitive scopes.
After authentication, grant the operating account email access to the desired Destination, following specific instructions for Google Ads or Display & Video 360 accounts.
The final step involves setting up the SDK for your preferred programming language (REST, .NET, Java, Python, Node.js, PHP) by downloading, installing, and configuring the relevant libraries.

Here's how to set up access to the Data Manager API with an SDK or REST.

Choose the type of setup process you want to follow.

Select Advertiser if you're using credentials for a Google Account that is a user in the advertiser accounts you want to manage.
Select Data Partner if you're using credentials for a Google Account that is a user in a data partner account, and you want to manage advertiser accounts that have a partner link to the data partner account.

Prerequisites

Before you can use the Data API, make sure you have the following:

A Google Cloud project. You can use an existing project or create a new project specifically for the Data Manager API.
A Google Account that has the serviceusage.services.enable permission on your Google Cloud project, or has a role that includes that permission. For example, roles/owner and roles/serviceusage.serviceUsageAdmin both include the serviceusage.services.enable permission. To check your permissions, see View current access.
The Google Cloud CLI installed.

Enable the API

If you haven't already, enable the Data Manager API by clicking Enable the Data Manager API or follow the instructions to perform this step manually.

If you can't find the Data Manager API or Enable the Data Manager API fails, verify your Google Account meets the prerequisites.

Set up authentication

You can use any of the Authentication methods at Google besides API keys. We recommend reviewing how to Choose the right authentication method for your use case to decide which approach is appropriate for your use case.

Two common authentication methods are user accounts and service accounts:

User accounts: Represent people who interact with Google APIs and services directly.
Service accounts: Represent apps, not people, as the users. They let your apps manage authentication and authorization. For example, if an app needs to access Google Cloud resources.

Your integration can use Application Default Credentials (ADC) to automatically find credentials from the environment so you don't have to change the client code to authenticate.

Choose User account or Service account impersonation to set up ADC:

Here are the steps to Use service account impersonation to authenticate:

Click the following Create service account button or follow the instructions to select or create a service account.

Create service account
Grant the service account the Service Usage Consumer IAM role (roles/serviceusage.serviceUsageConsumer), which includes the serviceusage.services.use permission that allows the the service account to send API requests for the project.
```
gcloud projects add-iam-policy-binding PROJECT_ID \
 --member="serviceAccount:SERVICE_ACCOUNT_EMAIL" \
 --role="roles/serviceusage.serviceUsageConsumer"
```
Grant your Google Account the Service Account Token Creator IAM role (roles/iam.serviceAccountTokenCreator) on the service account.

Note: This step is required even when your Google Account is an owner of the project.
```
gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_EMAIL \
 --member="user:USER_EMAIL" \
 --role="roles/iam.serviceAccountTokenCreator"
```

Configure your ADC by running the following command:

gcloud auth application-default login \
  --impersonate-service-account=SERVICE_ACCOUNT_EMAIL \
  --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform"

If you want to use the same credentials for the Data Manager API and the Google Ads API, include the Google Ads API scope in the --scopes list:

gcloud auth application-default login \
  --impersonate-service-account=SERVICE_ACCOUNT_EMAIL \
  --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/adwords,https://www.googleapis.com/auth/cloud-platform" \

If you want to use the same credentials for the Data Manager API and the Display & Video 360 API, include the Display & Video 360 API scope in the --scopes list:

gcloud auth application-default login \
  --impersonate-service-account=SERVICE_ACCOUNT_EMAIL \
  --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/display-video,https://www.googleapis.com/auth/cloud-platform"

When prompted to sign in, login as your Google Account that has the Service Account Token Creator role.

Confirm credentials are setup correctly using the following command. If successful, the command prints an access token to the console.
```
gcloud auth application-default print-access-token --scopes="https://www.googleapis.com/auth/datamanager"
```

To learn more about authentication and credentials for your app, see Authentication methods at Google and How Application Default Credentials works.

Set up account access

Grant the email associated with your service account access to the Destination.

If using a Google Ads account, complete Account access setup to add the service account to the Google Ads account or a parent Google Ads manager account.
If using a Display & Video 360 account, follow the instructions to create a Display & Video 360 user that's associated with the service account.
If using a Google Analytics property, follow the instructions to add the email of the user to the account.

Next steps

Install a client library and run code samples to try your first Data Manager API request.

Install a client library