/data-manager-api-setup

name: data-manager-api-setup
description: >-
  Guides developers through client library installation and authentication setup
  steps for the Data Manager API. Use this skill when a user is getting started
  with the Data Manager API and needs to setup their local environment, install
  the client library, or setup access to the API. Don't use for implementing
  audience or event ingestion logic (use the data-manager-api-audience-ingestion
  or data-manager-api-event-ingestion skills instead).
metadata:
  version: "1.1.0"
  category: GoogleAds

Data Manager API Setup

Setup Authentication

Refer to [Set up API access](https://developers.google.com/data-manager/api/devguides/quickstart/set-up-access.md.txt) for more details.

1. Enable the API

**Prerequisites**: A Google Cloud project, the Google Cloud CLI (`gcloud`), and a Google Account with a project role that can enable APIs, such as **Owner**, **Editor**, or **Service Usage Admin**. Always tell the user about the required role. If `gcloud` isn't installed, prompt the user to install it first.

gcloud services enable datamanager.googleapis.com --project={project_id}
gcloud services list --enabled --project=PROJECT_ID --filter="datamanager.googleapis.com"

2. Generate Application Default Credentials (ADC)

Choose the method that matches the user's scenario:

• **User account** (API calls are made as the user's own Google Account): The

Data Manager API scopes are sensitive, so the user must first configure their project's Google Auth Platform: 1. **Data Access** page: Add the Data Manager API scopes. 2. **Audience** page: Set **Publishing status** to **Testing**. Use the **Internal** user type for a Google Workspace organization, or **External** with the user's account added as a **Test user**. 3. Create (or reuse) a **Desktop app** OAuth client and download its JSON configuration file. 4. The user runs the following command, which opens a browser login:

        gcloud auth application-default login \
          --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform" \
          --client-id-file="{client_id_file_path}"

**Unverified app screen**: This warning appears because the Data Manager API scopes are sensitive. During **Testing**, External test users still see it and can continue past it. Before other users can sign in, the app must complete [OAuth app verification](https://developers.google.com/data-manager/api/devguides/concepts/oauth-verification.md.txt). Service accounts don't need verification.

• **Service account** (API calls are made as an app identity instead of a

person): For local development, use service account impersonation rather than a service account key, since keys are a security risk if not managed carefully.

• Grant the Service Account the `Service Usage Consumer` IAM role

(`roles/serviceusage.serviceUsageConsumer`) on the project.

• Grant the user executing `gcloud` the Token Creator role

(`roles/iam.serviceAccountTokenCreator`) on that Service Account.

• Run:

        gcloud auth application-default login \
          --impersonate-service-account={service_account_email} \
          --scopes="https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform"

• **Data partner creating partner links** in advertiser accounts: Read

[Partner Links](references/partner-links.md).

**Multiple APIs**: To use the same credentials for other APIs, append their scopes to the `--scopes` list in the commands above (e.g., `https://www.googleapis.com/auth/adwords` for the Google Ads API or `https://www.googleapis.com/auth/display-video` for the Display & Video 360 API).

**Verify**: `gcloud auth application-default print-access-token` prints an access token when credentials are set up correctly.

**Troubleshooting `PERMISSION_DENIED` with a valid token**: Add the user or service account to the destination account (for example, the Google Ads account or its manager account). For service accounts, also confirm the `Service Usage Consumer` role on the Cloud project.

**Production**: For production authentication (workloads in or outside Google Cloud, apps that act on behalf of other users, or partner links), see [Deploy to production](https://developers.google.com/data-manager/api/devguides/concepts/deploy.md.txt).

Install Client & Utility Libraries

Refer to [Install a client library](https://developers.google.com/data-manager/api/devguides/quickstart/install-library.md.txt) for more details.

The companion utility libraries provide pre-built helper classes and functions to correctly format, hash, and encrypt user identifiers (such as emails, phone numbers, and physical addresses) prior to API ingestion. Use of these libraries is highly recommended to ensure that user identifier formatting matches the API's specifications.

Select the language-specific installation guide below:

• [Python Setup Reference](references/python.md) (packages: `google-ads-datamanager` and `google-ads-datamanager-util`)
• [Java Setup Reference](references/java.md) (packages: `com.google.api-ads:data-manager` and `com.google.api-ads:data-manager-util`)
• [Node Setup Reference](references/node.md) (packages: `@google-ads/datamanager` and `@google-ads/datamanager-util`)
• [PHP Setup Reference](references/php.md) (packages: `googleads/data-manager` and `googleads/data-manager-util`)
• [.NET Setup Reference](references/dotnet.md) (packages: `Google.Ads.DataManager.V1` and `Google.Ads.DataManager.Util`)