Here's how to set up access to the Data Manager API with an SDK or REST.

## Prerequisites

1. A [Google Cloud project](https://cloud.google.com/resource-manager/docs/creating-managing-projects) or a Google
   Account that you want to own the project.

   - **If you don't have a project**, the setup process in the next section creates one for you.
   - **If you already have a project** , make sure your Google Account has a
     role that can enable APIs on the project, such as
     [**Owner**](https://docs.cloud.google.com/iam/docs/roles-overview#basic), [**Editor**](https://docs.cloud.google.com/iam/docs/roles-overview#basic),
     or **[Service Usage Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceusage#serviceusage.serviceUsageAdmin)** . To check your role, open the [IAM
     page](https://console.cloud.google.com/iam-admin/iam) in the Google Cloud console, select your
     project, and find your Google Account in the list.

     For more details, see [View current access](https://cloud.google.com/iam/docs/granting-changing-revoking-access#view-access).
2. The Google Cloud CLI [installed](https://cloud.google.com/sdk/docs/install).

## Enable the API

If you haven't already, enable the Data Manager API in your
Google Cloud project by clicking **Enable the Data Manager API** or
follow the [instructions](https://support.google.com/googleapi/answer/6158841) to
perform this step manually.

> [!TIP]
> **Tip:** If you don't already have a Google Cloud project, **Enable the Data Manager API** creates one for you.

Enable the Data Manager API

If you can't find the Data Manager API or **Enable the Data Manager API** fails, verify
your Google Account meets the [prerequisites](https://developers.google.com/data-manager/api/devguides/quickstart/set-up-access#prerequisites).

## Set up authentication

You can use any of the [Authentication methods at Google](https://cloud.google.com/docs/authentication) besides API keys. We
recommend reviewing how to [Choose the right authentication method for your use
case](https://cloud.google.com/docs/authentication#auth-decision-tree) to decide which
approach is appropriate for your use case.

Two common authentication methods are [user accounts](https://cloud.google.com/docs/authentication#user-accounts) and [service accounts](https://cloud.google.com/docs/authentication#service-accounts):

- **User accounts**: Represent people who interact with Google APIs and services directly.
- **Service accounts**: Represent apps, not people, as the users. They let your apps manage authentication and authorization. For example, if an app needs to access Google Cloud resources.

Your integration can use [Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials) to
automatically find credentials from the environment so you don't have to change
the client code to authenticate.

Choose **User account** or **Service account** to set up ADC:

### User account

Here are the steps to authenticate with [user account
credentials](https://cloud.google.com/docs/authentication#user-accounts):

1. Configure the [Google Auth Platform](https://support.google.com/cloud/topic/15540269) settings for your project.

   > [!IMPORTANT]
   > **Important:** Any Google Cloud app used to obtain user credentials for a Data Manager API scope must eventually undergo [Google
   > OAuth verification](https://support.google.com/cloud/answer/7454865#verification) to avoid an [unverified UI
   > screen](https://support.google.com/cloud/answer/7454865) for its users. During initial development and testing, you can use the app without verification by adding test users. For details on the verification process and production recommendations, see [OAuth app verification](https://developers.google.com/data-manager/api/devguides/concepts/oauth-verification). Verification isn't required for service accounts or certain other scenarios, such as internal applications. See [When is verification not
   > needed](https://support.google.com/cloud/answer/13464323) for details.

   1. Open the
      [Branding page](https://console.developers.google.com/auth/branding)
      in the Google Cloud console.

   2. Select your project.

   3. Fill out the form and click **Create**.

2. Since the Data Manager API uses [sensitive scopes](https://support.google.com/cloud/answer/13463073), the
   following steps are required:

   1. Go to the [Data Access](https://console.cloud.google.com/auth/scopes) settings for your project.

   2. Click **Add or remove scopes**.

   3. In the list of scopes, find **Data Manager API** and check the box
      for each scope your application requires:

      - **`.../auth/datamanager`**: Select this scope for standard API
        operations, such as managing customer data, audiences, and
        events. This is the primary scope used throughout this guide.

      - **`.../auth/datamanager.partnerlink`** : Select this scope only
        if you're a data partner creating or deleting
        [partner links](https://developers.google.com/data-manager/api/devguides/accounts/partner-links) in advertiser accounts.

   4. Click **Update**.

   5. Click **Save**.

   6. Go to [Audience](https://console.developers.google.com/auth/audience) in
      the Google Cloud console and configure the settings
      for initial development:

      - Set **Publishing status** to **Testing**.
      - Set **User type** to **Internal** (if your project is in a Google Workspace organization) or **External** (if it's not).
      - If using **External** , add the Google Accounts you use to generate credentials as **Test users**.

      Learn more about these settings in
      [Manage App Audience](https://support.google.com/cloud/answer/15549945).
3. Click **Create OAuth2 client** to create an OAuth2
   client in the project, or follow the
   [instructions](https://support.google.com/cloud/answer/15549257)
   to create a **Desktop** OAuth2 client. You can skip this step if you
   already have a **Desktop** OAuth2 client that you want to use for the
   Data Manager API.

   If you click **Create OAuth2 client** , select **Desktop app** when
   prompted to **Configure your OAuth client** so you can use the client in
   the remaining steps.

   > [!NOTE]
   > **Note:** If you are a data partner and want an OAuth client specifically for obtaining credentials from advertisers to create [partner links](https://developers.google.com/data-manager/api/devguides/accounts/partner-links), select **Web server** or **Web
   > browser** when prompted to **Configure your OAuth client** , and follow the instructions to [Get credentials for the advertiser account](https://developers.google.com/data-manager/api/devguides/accounts/partner-links#get-credentials).


   Create OAuth2 client

   In the last step, click **DOWNLOAD CLIENT CONFIGURATION** and note the
   download location you choose.
4. Generate a local ADC file by running the following command. This command
   launches a web flow where you are prompted to login to the Google
   Account you're using with the API.

   Replace <var translate="no">PATH_TO_CLIENT_JSON</var> with name of the JSON file you
   downloaded.

       gcloud auth application-default login \
         --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform" \
         --client-id-file="PATH_TO_CLIENT_JSON"

   If you want to use the same credentials for the Data Manager API and the
   [Google Ads API](https://developers.google.com/google-ads/api), include the Google Ads API scope in the
   `--scopes` list:

       gcloud auth application-default login \
         --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/adwords,https://www.googleapis.com/auth/cloud-platform" \
         --client-id-file="PATH_TO_CLIENT_JSON"

   If you want to use the same credentials for the Data Manager API and the
   [Display \& Video 360 API](https://developers.google.com/display-video/api), include the Display \& Video 360 API scope in the
   `--scopes` list:

       gcloud auth application-default login \
         --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/display-video,https://www.googleapis.com/auth/cloud-platform" \
         --client-id-file="PATH_TO_CLIENT_JSON"

5. Confirm credentials are setup correctly using the following command.
   If successful, the command prints an access token to the console.

   <br />

       gcloud auth application-default print-access-token

### Service account

Here are the steps to create a service account and use [service account
impersonation](https://cloud.google.com/docs/authentication/use-service-account-impersonation) to authenticate in a local
development environment. These steps use impersonation instead of service
account keys because [service account keys can become a security risk if not
managed carefully](https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys).

1. Click the following **Create service account** button or follow the
   [instructions](https://cloud.google.com/iam/docs/service-accounts-create) to
   select or create a service account.


   Create service account
2. Grant the service account the [Service Usage Consumer](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceusage#serviceusage.serviceUsageConsumer) IAM role
   (`roles/serviceusage.serviceUsageConsumer`), which includes the
   [`serviceusage.services.use` permission](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceusage#serviceusage.services.use) that allows the
   service account to send API requests for the project.

       gcloud projects add-iam-policy-binding PROJECT_ID \
         --member="serviceAccount:SERVICE_ACCOUNT_EMAIL" \
         --role="roles/serviceusage.serviceUsageConsumer"

   > [!TIP]
   > **Tip:** If you are running your code on a Google Cloud resource (such as a Compute Engine VM, Cloud Run, or GKE), you can skip the remaining impersonation steps. Instead, [attach the service account directly to the
   > resource](https://developers.google.com/data-manager/api/devguides/concepts/deploy#google-cloud) and proceed to [Set up account access](https://developers.google.com/data-manager/api/devguides/quickstart/set-up-access#setup-accounts-access).

3. [Grant your Google Account](https://cloud.google.com/iam/docs/manage-access-service-accounts#grant-single-role) the [Service Account Token
   Creator](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.serviceAccountTokenCreator) IAM role (`roles/iam.serviceAccountTokenCreator`) on the
   service account.

   > [!NOTE]
   > **Note:** This step is required even when your Google Account is an owner of the project.

       gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_EMAIL \
         --member="user:USER_EMAIL" \
         --role="roles/iam.serviceAccountTokenCreator"

4. Configure your ADC by running the following command:

       gcloud auth application-default login \
         --impersonate-service-account=SERVICE_ACCOUNT_EMAIL \
         --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform"

   If you want to use the same credentials for the Data Manager API and the
   [Google Ads API](https://developers.google.com/google-ads/api), include the Google Ads API scope in the
   `--scopes` list:

       gcloud auth application-default login \
         --impersonate-service-account=SERVICE_ACCOUNT_EMAIL \
         --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/adwords,https://www.googleapis.com/auth/cloud-platform"

   If you want to use the same credentials for the Data Manager API and the
   [Display \& Video 360 API](https://developers.google.com/display-video/api), include the Display \& Video 360 API scope in the
   `--scopes` list:

       gcloud auth application-default login \
         --impersonate-service-account=SERVICE_ACCOUNT_EMAIL \
         --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/display-video,https://www.googleapis.com/auth/cloud-platform"

   When prompted to sign in, login as your Google Account that has the
   Service Account Token Creator role.
5. Confirm credentials are setup correctly using the following command. If
   successful, the command prints an access token to the console.

       gcloud auth application-default print-access-token --scopes="https://www.googleapis.com/auth/datamanager"

> [!NOTE]
> **Note:** The scope `https://www.googleapis.com/auth/datamanager` is the primary scope and works for all services in the Data Manager API. The narrower `https://www.googleapis.com/auth/datamanager.partnerlink` scope is used only for managing [partner links](https://developers.google.com/data-manager/api/devguides/accounts/partner-links).

To learn more about authentication and credentials for your app, see
[Authentication methods at Google](https://cloud.google.com/docs/authentication) and [How Application Default Credentials
works](https://cloud.google.com/docs/authentication/application-default-credentials).

## Set up account access

### User account

Select the tab that corresponds to your use case.

- Select **Advertiser** if you're using credentials for a Google Account that is a user in the advertiser accounts you want to manage.
- Select **Data Partner** if you're using credentials for a Google Account that is a user in a data partner account, and you want to manage advertiser accounts that have a [partner
  link](https://developers.google.com/data-manager/api/devguides/accounts/partner-links) to the data partner account. Data partner accounts are issued only after going through the approval process. To get started, fill out the [interest form](https://docs.google.com/forms/d/e/1FAIpQLScFEkLVqElsjYJ21h7z0mSUk8Tj1M3TEMwouFPQb7qyM-oI5w/viewform).

<br />

### Advertiser

Grant the email associated with the user access to the
[`Destination`](https://developers.google.com/data-manager/api/devguides/concepts/destinations).

### Google Ads

[Follow the instructions](https://support.google.com/google-ads/answer/6372672)
to add the email of the user to the Google Ads account or a parent
Google Ads manager account.

### Display \& Video 360

[Follow the instructions](https://support.google.com/displayvideo/answer/2723011)
to add the email of the user to the account.

### Google Analytics

[Follow the instructions](https://support.google.com/analytics/answer/9305788)
to add the email of the user to the account.

### Data Partner

Grant the email associated with the user access to your **data partner
account**. Commonly, data partners use a service account for API access.
However, if you use a user account for testing or other purposes, you
must grant your user account access to the data partner account.

Add the user's email to the data partner account through the Google Ads UI
by [following these
instructions](https://support.google.com/google-ads/answer/6372672).

### Service account

Select the tab that corresponds to your use case.

- Select **Advertiser** if you're using credentials for a Google Account that is a user in the advertiser accounts you want to manage.
- Select **Data Partner** if you're using credentials for a Google Account that is a user in a data partner account, and you want to manage advertiser accounts that have a [partner
  link](https://developers.google.com/data-manager/api/devguides/accounts/partner-links) to the data partner account. Data partner accounts are issued only after going through the approval process. To get started, fill out the [interest form](https://docs.google.com/forms/d/e/1FAIpQLScFEkLVqElsjYJ21h7z0mSUk8Tj1M3TEMwouFPQb7qyM-oI5w/viewform).

<br />

### Advertiser

Grant the email associated with your service account access to the
[`Destination`](https://developers.google.com/data-manager/api/devguides/concepts/destinations).

### Google Ads

Complete [Account access setup](https://developers.google.com/google-ads/api/docs/oauth/service-accounts#account_access_setup)
to add the service account to the Google Ads account or a parent
Google Ads manager account.

### Display \& Video 360

[Follow the instructions](https://support.google.com/displayvideo/answer/2723011)
to create a Display \& Video 360 user that's associated with the service
account.

### Google Analytics

[Follow the instructions](https://support.google.com/analytics/answer/9305788)
to add the email of the service account to the account.

### Data Partner

Grant the email associated with your service account access to your
**data partner account**.

Data partner account access is managed through the Google Ads UI. To add
the service account and set its access level, follow the steps in
[Account access setup](https://developers.google.com/google-ads/api/docs/oauth/service-accounts#account_access_setup).

## Next steps

- [Install a client library](https://developers.google.com/data-manager/api/devguides/quickstart/install-library) and run code samples to try your first Data Manager API request.
- Learn how to configure authentication when you [deploy to
  production](https://developers.google.com/data-manager/api/devguides/concepts/deploy).