data-manager-api-setup

# Data Manager API Setup ## Setup Authentication Refer to [Set up API access](https://developers.google.com/data-manager/api/devguides/quickstart/set-up-access.md.txt) for more details. ### 1. Enable the API **Prerequisites**: A Google Cloud project, the Google Cloud CLI (`gcloud`), and a Google Account with a project role that can enable APIs, such as **Owner**, **Editor**, or **Service Usage Admin**. Always tell the user about the required role. If `gcloud` isn't installed, prompt the user to install it first. ```shell gcloud services enable datamanager.googleapis.com --project={project_id} gcloud services list --enabled --project=PROJECT_ID --filter="datamanager.googleapis.com" ``` ### 2. Generate Application Default Credentials (ADC) Choose the method that matches the user's scenario: * **User account** (API calls are made as the user's own Google Account): The Data Manager API scopes are sensitive, so the user must first configure their project's Google Auth Platform: 1. **Data Access** page: Add the Data Manager API scopes. 2. **Audience** page: Set **Publishing status** to **Testing**. Use the **Internal** user type for a Google Workspace organization, or **External** with the user's account added as a **Test user**. 3. Create (or reuse) a **Desktop app** OAuth client and download its JSON configuration file. 4. The user runs the following command, which opens a browser login: ```shell gcloud auth application-default login \ --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform" \ --client-id-file="{client_id_file_path}" ``` **Unverified app screen**: This warning appears because the Data Manager API scopes are sensitive. During **Testing**, External test users still see it and can continue past it. Before other users can sign in, the app must complete [OAuth app verification](https://developers.google.com/data-manager/api/devguides/concepts/oauth-verification.md.txt). Service accounts don't need verification. * **Service account** (API calls are made as an app identity instead of a person): For local development, use service account impersonation rather than a service account key, since keys are a security risk if not managed carefully. * Grant the Service Account the `Service Usage Consumer` IAM role (`roles/serviceusage.serviceUsageConsumer`) on the project. * Grant the user executing `gcloud` the Token Creator role (`roles/iam.serviceAccountTokenCreator`) on that Service Account. * Run: ```shell gcloud auth application-default login \ --impersonate-service-account={service_account_email} \ --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform" ``` * **Data partner creating partner links** in advertiser accounts: Read [Partner Links](references/partner-links.md). **Multiple APIs**: To use the same credentials for other APIs, append their scopes to the `--scopes` list in the commands above (e.g., `https://www.googleapis.com/auth/adwords` for the Google Ads API or `https://www.googleapis.com/auth/display-video` for the Display & Video 360 API). **Verify**: `gcloud auth application-default print-access-token` prints an access token when credentials are set up correctly. **Troubleshooting `PERMISSION_DENIED` with a valid token**: Add the user or service account to the destination account (for example, the Google Ads account or its manager account). For service accounts, also confirm the `Service Usage Consumer` role on the Cloud project. **Production**: For production authentication (workloads in or outside Google Cloud, apps that act on behalf of other users, or partner links), see [Deploy to production](https://developers.google.com/data-manager/api/devguides/concepts/deploy.md.txt). ## Install Client & Utility Libraries Refer to [Install a client library](https://developers.google.com/data-manager/api/devguides/quickstart/install-library.md.txt) for more details. The companion utility libraries provide pre-built helper classes and functions to correctly format, hash, and encrypt user identifiers (such as emails, phone numbers, and physical addresses) prior to API ingestion. Use of these libraries is highly recommended to ensure that user identifier formatting matches the API's specifications. Select the language-specific installation guide below: * [Python Setup Reference](references/python.md) (packages: `google-ads-datamanager` and `google-ads-datamanager-util`) * [Java Setup Reference](references/java.md) (packages: `com.google.api-ads:data-manager` and `com.google.api-ads:data-manager-util`) * [Node Setup Reference](references/node.md) (packages: `@google-ads/datamanager` and `@google-ads/datamanager-util`) * [PHP Setup Reference](references/php.md) (packages: `googleads/data-manager` and `googleads/data-manager-util`) * [.NET Setup Reference](references/dotnet.md) (packages: `Google.Ads.DataManager.V1` and `Google.Ads.DataManager.Util`)