You need OAuth 2.0 application credentials when calling the Search Ads 360 Reporting API. If you're making API calls as
a Search Ads 360 Manager Account, you also need to specify a [`login-customer-id`](https://developers.google.com/search-ads/reporting/concepts/login-customer-id) header
with each request. This page describes how to set these values and documents
several additional API-specific HTTP headers that are sent and received when
using the REST interface.

## OAuth 2.0 credentials

The Search Ads 360 Reporting API uses *application credentials* for identifying and authorizing API
requests. OAuth 2.0 clients can be configured. All Search Ads 360 Reporting API calls must be authorized through OAuth2. OAuth2 enables your Search Ads 360 Reporting API client app to access a user's Search Ads 360 account without having to handle or store the user's login info.

If you are new to Google APIs, you can use
[oauth2l](https://github.com/google/oauth2l) or the [OAuth 2.0
Playground](https://developers.google.com/search-ads/reporting/concepts/oauth-playground) to experiment with
application credentials and the Search Ads 360 Reporting API before writing the code for your
app. You can also generate an OAuth refresh token by running the provided [user credential generation script](https://developers.google.com/search-ads/reporting/sample-code/generate-user-credentials).

### Generating new access tokens

Once you have a *client ID* , *client secret* , and *refresh token* , you can
generate a new access token for use in API calls with the
[`curl`](https://curl.haxx.se/) command line tool:

> [!NOTE]
> **Note:** The version `v3` in the OAuth endpoint URL is unrelated to the Search Ads 360 Reporting API version and should not change when migrating to newer versions of Search Ads 360 Reporting API.

    curl \
      --data "grant_type=refresh_token" \
      --data "client_id=CLIENT_ID" \
      --data "client_secret=CLIENT_SECRET" \
      --data "refresh_token=REFRESH_TOKEN" \
      https://www.googleapis.com/oauth2/v3/token

You then use the *access token* returned by the curl request in the
`Authorization` HTTP header of every API call to the Search Ads 360 Reporting API:

    GET /v0/customers:listAccessibleCustomers HTTP/1.1
    Host: searchads360.googleapis.com
    Authorization: Bearer ACCESS_TOKEN

## Request headers

### Login customer ID

For Search Ads 360 Reporting API calls made by a manager to a client account (that is, when
logging in as a manager to make API calls to one of its client accounts), you
also need to supply the `login-customer-id` HTTP header. This value represents
the Search Ads 360 customer ID of the manager making the API call.

Including this header is equivalent to choosing an account in the Search Ads 360 UI
after signing in or clicking on your profile image at the top-right corner of
the page. When specifying the customer ID, be sure to remove any hyphens (---),
for example: `1234567890`, not `123-456-7890`.

    GET /v0/customers:listAccessibleCustomers HTTP/1.1
    Host: searchads360.googleapis.com
    Authorization: Bearer ACCESS_TOKEN
    login-customer-id: MANAGER_CUSTOMER_ID

## Response headers

The following headers are returned in HTTP responses from the API.

### Request ID

The `request-id` is a string that uniquely identifies the API request. When
debugging or troubleshooting problems with specific API calls, the `request-id`
is an important identifier to have handy when contacting Google developer
support.

    request-id: 2a5Cj89VV7CNhya1DZjjrC