OAuth Service Account Flow

This guide will walk you through how to set up OAuth2 for API access using your own credentials with service accounts. These steps only need to be done once, unless you revoke or delete your OAuth2 credentials.

Create OAuth2 credentials

Note: This flow requires a Google Workspace domain and a service account that was granted domain-wide delegation access by a super administrator for the domain.

Generate a service account ID and a *.JSON file by following the linked instructions, then come back to this page.

Add a private key JSON and an impersonated email to configuration

Set the private key JSON file path and impersonated email in your configuration. If you're using a google-ads.yaml file, YAML string, or dict, add the following:

json_key_file_path: JSON_KEY_FILE_PATH
impersonated_email: IMPERSONATED_EMAIL

If you're using environment variables, add the following to your bash configuration or environment:

export GOOGLE_ADS_JSON_KEY_FILE_PATH=JSON_KEY_FILE_PATH
export GOOGLE_ADS_IMPERSONATED_EMAIL=IMPERSONATED_EMAIL

Note: When reading in the configuration, the library first looks for credentials for the OAuth2 desktop or web app flows, and will use them if found. So if you want to use a Service Account authentication, make sure credentials for the other flows are not present in your configuration.