Untuk mendiskusikan dan memberikan masukan tentang produk kami, bergabunglah ke channel Discord Google Ads resmi di server Komunitas Iklan dan Pengukuran Google.
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Panduan ini membahas cara mengakses Google Ads API dengan akun layanan.
Akun layanan adalah akun
milik aplikasi Anda, bukan milik pengguna akhir perorangan. Akun layanan memungkinkan interaksi server-ke-server antara aplikasi web dan layanan Google.
Aplikasi Anda memanggil Google API atas nama akun layanan, sehingga pengguna tidak
terlibat secara langsung.
Akun layanan menggunakan alur OAuth 2.0 yang tidak memerlukan otorisasi manusia, tetapi menggunakan file kunci yang hanya dapat diakses oleh aplikasi Anda.
Penggunaan akun layanan memberikan dua manfaat utama:
Otorisasi untuk akses Google API dilakukan sebagai langkah konfigurasi, sehingga menghindari komplikasi yang terkait dengan alur OAuth 2.0 lainnya yang memerlukan interaksi pengguna.
Alur pernyataan OAuth 2.0 memungkinkan aplikasi Anda meniru pengguna lain jika
diperlukan.
Ada dua cara untuk memberikan otorisasi dengan akun layanan: secara langsung atau
dengan peniruan identitas (tidak direkomendasikan).
[Direkomendasikan] Otorisasi dengan akses akun langsung
Dalam opsi ini, Anda memberikan akses langsung akun layanan ke akun Google Ads Anda.
Download kunci akun layanan dalam format JSON dan catat ID serta email akun layanan.
Login ke akun Google Ads Anda sebagai administrator. Buka Admin > Akses dan keamanan.
Klik tombol + di tab Pengguna.
Ketik email akun layanan ke dalam kotak input Email. Pilih tingkat akses akun yang sesuai, lalu klik tombol Tambahkan akun. Perhatikan bahwa tingkat akses Email dan Admin tidak didukung untuk akun
layanan.
Akun layanan diberi akses.
Konfigurasi library klien
Pilih tab yang sesuai dengan bahasa pemrograman Anda untuk mendapatkan petunjuk tentang cara mengonfigurasi library klien.
Java
Tetapkan jalur JSON kunci pribadi dalam konfigurasi Anda. Jika Anda menggunakan
file ads.properties, tambahkan kode berikut:
Tetapkan jalur JSON kunci pribadi dan ID akun yang didelegasikan dalam konfigurasi Anda. Jika Anda menggunakan file googleads.properties, tambahkan
kode berikut:
jsonKeyFilePath=JSON_KEY_FILE_PATH
Jika Anda menggunakan variabel lingkungan, tambahkan kode berikut ke konfigurasi atau lingkungan Bash Anda:
[Tidak Direkomendasikan] Pemberian otorisasi menggunakan peniruan identitas
Dalam opsi ini, Anda meniru identitas pengguna yang memiliki akses ke akun Google Ads Anda menggunakan akun layanan. Cara ini hanya berfungsi untuk pelanggan Google Workspace. Akun layanan hanya dapat meniru identitas pengguna (alamat email) di
Google Workspace yang sama.
Pengguna Google Ads dengan izin di akun Google Ads yang ingin Anda akses.
Penyiapan akses akun layanan
Karena peniruan identitas pengguna hanya dikontrol di tingkat domain, penggunaan akun layanan dan alur pernyataan dengan Google OAuth 2.0 mengharuskan Anda memiliki domain sendiri yang terdaftar di Google Workspace. Aplikasi Anda dan penggunanya kemudian dapat
meniru identitas pengguna mana pun di domain.
Sekarang Anda dapat menggunakan akun layanan untuk mengakses akun Google Ads dengan alur pernyataan OAuth 2.0.
Konfigurasi library klien
Pilih tab yang sesuai dengan bahasa pemrograman Anda untuk mendapatkan petunjuk tentang cara mengonfigurasi library klien.
Java
Tetapkan jalur JSON kunci pribadi dan ID akun yang didelegasikan dalam konfigurasi Anda.
Jika Anda menggunakan file ads.properties, tambahkan kode berikut:
Tetapkan jalur JSON kunci pribadi dan email yang di-impersonate dalam konfigurasi Anda.
Jika Anda menggunakan google-ads.yaml file, string YAML, atau dict, tambahkan
berikut ini:
Tetapkan jalur JSON kunci pribadi dan ID akun yang didelegasikan dalam konfigurasi Anda. Jika Anda menggunakan file googleads.properties, tambahkan
kode berikut:
Karena akun layanan memiliki kontrol delegasi tingkat domain untuk domain Google Workspace Anda, penting untuk melindungi file kunci yang memungkinkan akun layanan mengakses layanan Google yang diizinkan untuknya. Hal ini
terutama benar karena akun layanan tersebut memiliki kemampuan untuk meniru identitas pengguna
mana pun di domain.
Praktik baik lainnya adalah mengizinkan akun layanan mengakses hanya serangkaian API minimum yang diperlukan. Tindakan ini merupakan langkah antisipasi untuk membatasi jumlah data yang dapat diakses penyerang jika file kunci akun layanan disusupi.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Informasi yang saya butuhkan tidak ada","missingTheInformationINeed","thumb-down"],["Terlalu rumit/langkahnya terlalu banyak","tooComplicatedTooManySteps","thumb-down"],["Sudah usang","outOfDate","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Masalah kode / contoh","samplesCodeIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[[["\u003cp\u003eThis guide explains how to use service accounts for server-to-server interactions with the Google Ads API, enabling app access without direct user involvement.\u003c/p\u003e\n"],["\u003cp\u003eService accounts offer simplified authorization and the ability to impersonate other users, though impersonation is a legacy approach and discouraged for security reasons.\u003c/p\u003e\n"],["\u003cp\u003eTwo authorization methods are detailed: direct access, granting the service account permissions to your Google Ads account, and impersonation (for Google Workspace users only), allowing the service account to act on behalf of a specific user.\u003c/p\u003e\n"],["\u003cp\u003eConfiguration instructions are provided for various client libraries (Java, .NET, Python, PHP, Ruby, Perl) to set up service account authentication.\u003c/p\u003e\n"],["\u003cp\u003eSecurity concerns are highlighted, emphasizing the importance of protecting the service account key file and limiting API access to minimize potential risks.\u003c/p\u003e\n"]]],[],null,["# Service Accounts\n\nThis guide discusses how to access the Google Ads API with service accounts.\n\nA [service account](/identity/protocols/OAuth2#serviceaccount) is an account\nthat belongs to your app instead of to an individual end user. Service accounts\nenable server-to-server interactions between a web app and a Google service.\nYour app calls Google APIs on behalf of the service account, so users aren't\ndirectly involved.\n\nService accounts employ an OAuth 2.0 flow that doesn't require human\nauthorization, using instead a key file that only your app can access.\n\nUsing service accounts provides two key benefits:\n\n- Authorization for Google API access is done as a configuration step, thus\n avoiding the complications associated with other OAuth 2.0 flows that require\n user interactions.\n\n- The OAuth 2.0 assertion flow lets your app impersonate other users if\n necessary.\n\nThere are two ways to authorize with service accounts: directly or\nwith impersonation (not recommended).\n\n\\[Recommended\\] Authorization with direct account access\n--------------------------------------------------------\n\nIn this option, you give the service account direct access to your Google Ads\naccount.\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n### Account access setup\n\n1. Start by [creating a service account and credentials](/workspace/guides/create-credentials#service-account).\n\n Download the service account key in JSON format and note the service account\n ID and email.\n2. Sign in to your Google Ads account as an administrator. Navigate to **Admin \\\u003e Access and security**.\n\n3. Click the **+** button under the **Users** tab.\n\n4. Type the service account email into the **Email** input box. Select the\n appropriate level of account access level and click the **Add account**\n button. Note that Email and Admin access levels are not supported for service\n accounts.\n\n5. The service account is granted access.\n\n### Client library configuration\n\nSelect the tab corresponding to your programming language for instructions on\nhow to configure your client library. \n\n### Java\n\nSet the private key JSON path in your configuration. If you're using an\n`ads.properties` file, add the following: \n\n api.googleads.serviceAccountSecretsPath=\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\n\nSee the [configuration guide](/google-ads/api/docs/client-libs/java/config-file) for\nadditional details.\n\n### .NET\n\nConfigure the following keys in your `App.config / Web.config`. See the\n[configuration guide](/google-ads/api/docs/client-libs/dotnet/configuration) for\nadditional details. \n\n \u003cadd key=\"OAuth2Mode\" value=\"SERVICE_ACCOUNT\" /\u003e\n \u003cadd key=\"OAuth2SecretsJsonPath\" value=\"\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\" /\u003e\n\n### Python\n\nSet the private key JSON path in your configuration. If you're using a\n`google-ads.yaml file`, YAML string, or `dict`, add the following: \n\n json_key_file_path: \u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\n\nIf you're using environment variables, add the following to your Bash\nconfiguration or environment: \n\n export GOOGLE_ADS_JSON_KEY_FILE_PATH=\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\n\n### PHP\n\nConfigure the following keys in your `google_ads_php.ini`. See the\n[configuration guide](/google-ads/api/docs/client-libs/php/configuration) for additional\ndetails. \n\n ; For service account flow.\n jsonKeyFilePath = \"\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\"\n scopes = \"https://www.googleapis.com/auth/adwords\"\n\n### Ruby\n\nConfigure the following keys in your [`google_ads_config.rb`](//github.com/googleads/google-ads-ruby/blob/HEAD/google_ads_config.rb#L29). \n\n c.keyfile = '\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e'\n\n### Perl\n\nSet the private key JSON path and delegate account ID in your\nconfiguration. If you're using a `googleads.properties` file, add the\nfollowing: \n\n jsonKeyFilePath=\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\n\nIf you're using environment variables, add the following to your Bash\nconfiguration or environment: \n\n export GOOGLE_ADS_JSON_KEY_FILE_PATH=\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\n\n\\[Not Recommended\\] Authorization using impersonation\n-----------------------------------------------------\n\n| **Caution:** This is a legacy approach that works only for Google Workspace users. Its use is highly discouraged; this documentation is maintained only for reference purposes. Newer users should use the [Authorization with direct account access](#direct) approach, which works for all users including Google Workspace users and is simpler to configure and use.\n\nIn this option, you impersonate a user who has access to your Google Ads account\nusing the service account. This approach works only for Google Workspace\ncustomers. A service account can only impersonate users (email addresses) in\nthe same [Google Workspace](//workspace.google.com/).\n\n### Prerequisites\n\n- A [Google Workspace domain](//workspace.google.com/) that you own such as\n `mydomain.com` or `mybusiness.com`\n\n- A Google Ads API developer token and optionally a test account\n\n- The [client library](/google-ads/api/docs/client-libs) for the language you're using\n\n- A Google API Console project that has been [configured for the\n Google Ads API](/google-ads/api/docs/oauth/cloud-project#enable_the_in_your_project)\n\n- A Google Ads user with permissions on the Google Ads account you want to access.\n\n### Service account access setup\n\nSince user impersonation is controlled only at the domain level, using service\naccounts and assertion flow with Google OAuth 2.0 requires you to have your own\ndomain registered with Google Workspace. Your app and its users can then\nimpersonate any user in the domain.\n\n1. Start by [creating a service account and credentials](/workspace/guides/create-credentials#service-account).\n\n Download the service account key in JSON format and note the service account\n ID.\n2. Share the service account ID and the Google Ads API scope\n (`https://www.googleapis.com/auth/adwords`) with your domain administrator.\n\n Request the domain administrator to delegate domain-wide authority to your\n service account.\n3. If you're the domain administrator, complete the [help center\n instructions](//support.google.com/a/answer/162106).\n\nYou can now use the service account to access your Google Ads account with the\nOAuth 2.0 assertion flow.\n\n### Client library configuration\n\nSelect the tab corresponding to your programming language for instructions on\nhow to configure your client library. \n\n### Java\n\nSet the private key JSON path and delegate account ID in your configuration.\nIf you're using an `ads.properties` file, add the following: \n\n api.googleads.serviceAccountSecretsPath=\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\n api.googleads.serviceAccountUser=\u003cvar translate=\"no\"\u003eIMPERSONATED_EMAIL\u003c/var\u003e\n\nSee the [configuration guide](/google-ads/api/docs/client-libs/java/config-file) for\nadditional details.\n\n### .NET\n\nConfigure the following keys in your `App.config / Web.config`. See the\nconfiguration guide for additional details. \n\n \u003cadd key=\"OAuth2Mode\" value=\"SERVICE_ACCOUNT\" /\u003e\n \u003cadd key=\"OAuth2SecretsJsonPath\" value=\"\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\" /\u003e\n\n \u003c!-- Supply the email address of the user to impersonate. --\u003e\n \u003cadd key=\"OAuth2PrnEmail\" value=\"\u003cvar translate=\"no\"\u003eIMPERSONATED_EMAIL\u003c/var\u003e\" /\u003e\n\n### Python\n\nSet the private key JSON path and impersonated email in your configuration.\nIf you're using a `google-ads.yaml file`, YAML string, or `dict`, add the\nfollowing: \n\n json_key_file_path: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eJSON_KEY_FILE_PATH\u003c/span\u003e\u003c/var\u003e\n impersonated_email: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eIMPERSONATED_EMAIL\u003c/span\u003e\u003c/var\u003e\n\nIf you're using environment variables, add the following to your Bash\nconfiguration or environment: \n\n export GOOGLE_ADS_JSON_KEY_FILE_PATH=\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\n export GOOGLE_ADS_IMPERSONATED_EMAIL=\u003cvar translate=\"no\"\u003eIMPERSONATED_EMAIL\u003c/var\u003e\n\n### PHP\n\nConfigure the following keys in your `google_ads_php.ini`. See the\n[configuration guide](/google-ads/api/docs/client-libs/php/configuration) for additional\ndetails. \n\n ; For service account flow.\n jsonKeyFilePath = \"\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\"\n scopes = \"https://www.googleapis.com/auth/adwords\"\n impersonatedEmail = \"\u003cvar translate=\"no\"\u003eIMPERSONATED_EMAIL\u003c/var\u003e\"\n\n### Ruby\n\nConfigure the following keys in your [`google_ads_config.rb`](//github.com/googleads/google-ads-ruby/blob/HEAD/google_ads_config.rb#L29). \n\n c.keyfile = '\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e'\n c.impersonate = '\u003cvar translate=\"no\"\u003eIMPERSONATED_EMAIL\u003c/var\u003e'\n\n### Perl\n\nSet the private key JSON path and delegate account ID in your\nconfiguration. If you're using a `googleads.properties` file, add the\nfollowing: \n\n jsonKeyFilePath=\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\n impersonatedEmail=\u003cvar translate=\"no\"\u003eIMPERSONATED_EMAIL\u003c/var\u003e\n\nIf you're using environment variables, add the following to your Bash\nconfiguration or environment: \n\n export GOOGLE_ADS_JSON_KEY_FILE_PATH=\u003cvar translate=\"no\"\u003eJSON_KEY_FILE_PATH\u003c/var\u003e\n export GOOGLE_ADS_IMPERSONATED_EMAIL=\u003cvar translate=\"no\"\u003eIMPERSONATED_EMAIL\u003c/var\u003e\n\n### Security concerns\n\nSince the service account has domain-level delegation control for your Google\nWorkspace domain, it's important to protect the key file that allows a service\naccount to access the Google services for which it's authorized. This is\nespecially true since that service account has the ability to impersonate any\nuser in the domain.\n\nAnother good practice is to allow service accounts to access only the minimum\nrequired set of APIs. This is a preemptive measure to limit the amount of data\nan attacker can access if the service account's key file is compromised."]]
