OAuth Service Account Flow

This guide will walk you through how to setup OAuth2 for API access using your own credentials using service accounts. These steps only need to be done once, unless you revoke or delete your OAuth2 credentials.

Step 1 - Creating OAuth2 credentials

Note: This flow requires a Google Workspace domain and the service account that you created needs to be granted domain wide delegation access by a super administrator for the domain.

Generate a service account ID and a *.JSON file by following the linked instructions, then come back to this page.

Step 2 - Adding Private Key JSON and Delegate Account to Configuration

Set the private key JSON file path and delegate account ID in your configuration. If you're using a google-ads.yaml file, YAML string or dict add the following:

path_to_private_key_file: PRIVATE_KEY_FILE_PATH
delegated_account: DELEGATE_ACCOUNT

If you're using environment variables add the following to your bash configuration or environment:

export GOOGLE_ADS_PATH_TO_PRIVATE_KEY_FILE=PRIVATE_KEY_FILE_PATH
export GOOGLE_ADS_DELEGATE_ACCOUNT=DELEGATE_ACCOUNT_ID

Note: When reading configuration the library will first look for credentials for the OAuth2 desktop or web app flows and will use them if found. So if you want to use a Service Account authentication, make sure credentials for the other flows are not present in your configuration.