Set up API access

    • Accessing the Data Manager API requires a Google Cloud project and a Google Account with the necessary permissions.

    • The Data Manager API must be explicitly enabled in your Google Cloud project settings.

    • Authentication for the Data Manager API can be set up using various methods, including user accounts and service accounts, with Application Default Credentials recommended for automatic credential finding.

    • Setting up access involves configuring Google Auth Platform settings and potentially undergoing Google OAuth verification for user accounts accessing sensitive scopes.

    • After authentication, grant the operating account email access to the desired Destination, following specific instructions for Google Ads or Display & Video 360 accounts.

    • The final step involves setting up the SDK for your preferred programming language (REST, .NET, Java, Python, Node.js, PHP) by downloading, installing, and configuring the relevant libraries.

    Here's how to set up access to the Data Manager API with an SDK or REST.

    Prerequisites

    Before you can use the Data API, make sure you have the following:

    1. A Google Cloud project . You can use an existing project or create a new project specifically for the Data Manager API.

    2. A Google Account that has the serviceusage.services.enable permission on your Google Cloud project, or has a role that includes that permission. For example, roles/owner and roles/serviceusage.serviceUsageAdmin both include the serviceusage.services.enable permission. To check your permissions, see View current access .

    3. The Google Cloud CLI installed .

    Enable the API

    If you haven't already, enable the Data Manager API by clicking Enable the Data Manager APIor follow the instructions to perform this step manually.

    Enable the Data Manager API

    If you can't find the Data Manager API or Enable the Data Manager APIfails, verify your Google Account meets the prerequisites .

    Set up authentication

    You can use any of the Authentication methods at Google besides API keys. We recommend reviewing how to Choose the right authentication method for your use case to decide which approach is appropriate for your use case.

    Two common authentication methods are user accounts and service accounts :

    • User accounts: Represent people who interact with Google APIs and services directly.
    • Service accounts: Represent apps, not people, as the users. They let your apps manage authentication and authorization. For example, if an app needs to access Google Cloud resources.

    Your integration can use Application Default Credentials (ADC) to automatically find credentials from the environment so you don't have to change the client code to authenticate.

    Choose User accountor Service accountto set up ADC:

    Here are the steps to authenticate with user account credentials :

    1. Configure the Google Auth Platform settings for your project.

      1. Open the Branding page in the Google Cloud Console.

      2. Select your project.

      3. Fill out the form and click Create.

    2. Since the Data Manager API scope is a sensitive scope , the following steps are required:

      1. Go to the Data Access settings for your project.

      2. Click Add or remove scopes.

      3. Check the box next to Data Manager APIin the list of scopes, and click Update.

      4. Click Save.

      5. Go to Audience in the Google Cloud Console and update the Publishing statusand User type. Learn more about these settings in Manage App Audience .

    3. Click Create OAuth2 clientto create an OAuth2 client in the project, or follow the instructions to create a DesktopOAuth2 client. You can skip this step if you already have a DesktopOAuth2 client that you want to use for the Data Manager API.

      If you click Create OAuth2 client, select Desktop appwhen prompted to Configure your OAuth clientso you can use the client in the remaining steps.

      Create OAuth2 client

      In the last step, click DOWNLOAD CLIENT CONFIGURATIONand note the download location you choose.

    4. Generate a local ADC file by running the following command. This command launches a web flow where you are prompted to login to the Google Account you're using with the API.

      Replace PATH_TO_CLIENT_JSON with name of the JSON file you downloaded.

       gcloud  
auth  
application-default  
login  
 \ 
  
--scopes = 
 "https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform" 
  
 \ 
  
--client-id-file = 
 " PATH_TO_CLIENT_JSON 
"

      If you want to use the same credentials for the Data Manager API and the Google Ads API , include the Google Ads API scope in the --scopes list:

       gcloud  
auth  
application-default  
login  
 \ 
  
--scopes = 
 "https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/adwords,https://www.googleapis.com/auth/cloud-platform" 
  
 \ 
  
--client-id-file = 
 " PATH_TO_CLIENT_JSON 
"

      If you want to use the same credentials for the Data Manager API and the Display & Video 360 API , include the Display & Video 360 API scope in the --scopes list:

       gcloud  
auth  
application-default  
login  
 \ 
  
--scopes = 
 "https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/display-video,https://www.googleapis.com/auth/cloud-platform" 
  
 \ 
  
--client-id-file = 
 " PATH_TO_CLIENT_JSON 
"

    5. Confirm credentials are setup correctly using the following command. If successful, the command prints an access token to the console.

       gcloud  
auth  
application-default  
print-access-token

    Here are the steps to Use service account impersonation to authenticate. These steps use impersonation instead of service account keys because service account keys can become a security risk if not managed carefully .

    1. Click the following Create service accountbutton or follow the instructions to select or create a service account.

      Create service account

    2. Grant the service account the Service Usage Consumer IAM role ( roles/serviceusage.serviceUsageConsumer ), which includes the serviceusage.services.use permission that allows the service account to send API requests for the project.

       gcloud  
projects  
add-iam-policy-binding  
 PROJECT_ID 
  
 \ 
  
--member = 
 "serviceAccount: SERVICE_ACCOUNT_EMAIL 
" 
  
 \ 
  
--role = 
 "roles/serviceusage.serviceUsageConsumer"

    3. Grant your Google Account the Service Account Token Creator IAM role ( roles/iam.serviceAccountTokenCreator ) on the service account.

       gcloud  
iam  
service-accounts  
add-iam-policy-binding  
 SERVICE_ACCOUNT_EMAIL 
  
 \ 
  
--member = 
 "user: USER_EMAIL 
" 
  
 \ 
  
--role = 
 "roles/iam.serviceAccountTokenCreator"

    4. Configure your ADC by running the following command:

       gcloud  
auth  
application-default  
login  
 \ 
  
--impersonate-service-account = 
 SERVICE_ACCOUNT_EMAIL 
  
 \ 
  
--scopes = 
 "https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform"

      If you want to use the same credentials for the Data Manager API and the Google Ads API , include the Google Ads API scope in the --scopes list:

       gcloud  
auth  
application-default  
login  
 \ 
  
--impersonate-service-account = 
 SERVICE_ACCOUNT_EMAIL 
  
 \ 
  
--scopes = 
 "https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/adwords,https://www.googleapis.com/auth/cloud-platform"

      If you want to use the same credentials for the Data Manager API and the Display & Video 360 API , include the Display & Video 360 API scope in the --scopes list:

       gcloud  
auth  
application-default  
login  
 \ 
  
--impersonate-service-account = 
 SERVICE_ACCOUNT_EMAIL 
  
 \ 
  
--scopes = 
 "https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/display-video,https://www.googleapis.com/auth/cloud-platform"

      When prompted to sign in, login as your Google Account that has the Service Account Token Creator role.

    5. Confirm credentials are setup correctly using the following command. If successful, the command prints an access token to the console.

       gcloud  
auth  
application-default  
print-access-token  
--scopes = 
 "https://www.googleapis.com/auth/datamanager"

    To learn more about authentication and credentials for your app, see Authentication methods at Google and How Application Default Credentials works .

    Set up account access

    Grant the email associated with the user access to the Destination .

    • If using a Google Ads account, follow the instructions to add the email of the user to the Google Ads account or a parent Google Ads manager account.
    • If using a Display & Video 360 account, follow the instructions to add the email of the user to the account.
    • If using a Google Analytics property, follow the instructions to add the email of the user to the account.
    • If accessing the Destination using a data partner account with a partner link from the advertiser account, follow the instructions to add the email of the user to the Data Partner account.

    Grant the email associated with your service account access to the Destination .

    • If using a Google Ads account, complete Account access setup to add the service account to the Google Ads account or a parent Google Ads manager account.
    • If using a Display & Video 360 account, follow the instructions to create a Display & Video 360 user that's associated with the service account.
    • If using a Google Analytics property, follow the instructions to add the email of the user to the account.
    • If accessing the Destination using a data partner account with a partner link from the advertiser account, complete Account access setup in the data partner account to add the service account and set its access level.

    Next steps

    Install a client library and run code samples to try your first Data Manager API request.

    Next
    Install a client library
    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: