Authentication
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
本文档介绍了如何向 Ad Manager API 进行身份验证。身份验证方式取决于您使用的界面和运行代码的环境，但所有 API 请求都必须包含具有 Ad Manager API 作用域的访问令牌。
Ad Manager 客户端库使用应用默认凭据生成具有 Ad Manager API 范围的访问令牌。本指南介绍了如何配置应用默认凭据。
如果您未使用客户端库，则仍需创建凭据
并使用它们来对请求进行授权
如需详细了解身份验证和授权，请参阅使用 OAuth 2.0 指南。
确定您的身份验证类型
| 身份验证类型 |
说明 |
| 服务账号
|
如果您想以专用账号（而非特定用户）的身份进行身份验证，请选择此选项。
了解详情。 |
| Web 应用
|
如果您想以授权您的应用访问其 Ad Manager 数据的任何用户身份进行身份验证，请选择此选项。
了解详情 |
| 本地开发
|
如果您想使用自己的 Google 账号或本地开发环境中的服务账号进行身份验证，请选择此选项。 |
启用 Ad Manager API
在 Google API 控制台 Cloud 项目中启用 Ad Manager API。
如果系统提示您选择一个项目或创建一个新项目，请视需要选择相应选项。
创建凭据
点击身份验证类型所对应的标签，然后按照相应说明
创建凭据：
服务账号
在 Google Cloud 上
如需对在 Google Cloud 上运行的工作负载进行身份验证，您可以使用
与代码所在的计算资源关联的服务账号
。
例如，您可以将服务账号关联到 Compute Engine 虚拟机 (VM) 实例、Cloud Run 服务或 Dataflow 作业。这种方法
是 Google Cloud 控制台上运行的代码的首选身份验证方法，
计算资源
如需了解可以将服务账号关联到的资源，以及有关将服务账号关联到资源的帮助，请参阅有关关联服务账号的文档。
在本地或在其他云服务提供商上
如需在 Google Cloud 外部设置身份验证，首选方法是使用工作负载身份联合；您需要创建一个凭据配置文件并将 GOOGLE_APPLICATION_CREDENTIALS 环境变量设置为指向它。相较于
创建服务账号密钥的过程
如果您无法配置工作负载身份联合，则必须创建一个服务账号并为该服务账号创建密钥：
打开 Google API 控制台凭据页面。
在“凭据”页面上，选择创建凭据，然后
选择服务账号。
点击要创建的服务账号的电子邮件地址
。
点击密钥标签页。
点击添加密钥下拉菜单，然后选择创建新密钥。
选择 JSON 作为密钥类型，然后点击创建。
将环境变量 GOOGLE_APPLICATION_CREDENTIALS 设置为 JSON 文件的路径。
Linux 或 macOS
export GOOGLE_APPLICATION_CREDENTIALS=KEY_FILE_PATH
Windows
set GOOGLE_APPLICATION_CREDENTIALS=KEY_FILE_PATH
Web 应用
打开 Google API 控制台凭据页面。
如果系统提示，请选择您启用了 Ad Manager API 的项目。
在“凭据”页面上，选择创建凭据，然后选择 OAuth 客户端 ID。
选择 Web 应用应用类型。
填写表单，然后点击创建。使用 PHP、Java、Python、Ruby 和 .NET 等语言和框架的应用必须指定已获授权的重定向 URI。重定向 URI 是 OAuth 2.0 服务器可以向其发送响应的端点。这些端点必须遵守 Google 的验证规则。
创建凭据后，下载 client_secret.json 文件。将文件安全地存储在只有您的应用可以访问的位置。
接下来，按照相应步骤获取 OAuth 2.0 访问令牌
本地开发
在本地环境中设置应用默认凭据 (ADC)。
安装 Google Cloud CLI，然后通过运行以下命令对其进行初始化
命令：
gcloud init
为您的 Google 账号创建本地身份验证凭据并设置
启用了 Ad Manager API 的项目的 ID：
gcloud auth application-default login --scopes="https://www.googleapis.com/auth/admanager"
gcloud auth application-default set-quota-project PROJECT_ID
或者，以服务账号的身份设置环境进行身份验证
将变量 GOOGLE_APPLICATION_CREDENTIALS 设置为密钥文件的路径。
Linux 或 macOS
export GOOGLE_APPLICATION_CREDENTIALS=KEY_FILE_PATH
Windows
set GOOGLE_APPLICATION_CREDENTIALS=KEY_FILE_PATH
服务账号
- 前往您的 Ad Manager 广告资源网。
- 点击管理标签。
- 确保已启用 API 访问权限。
- 点击添加服务账号用户按钮。
- 在表单中填写服务账号电子邮件地址。通过
必须将服务账号用户添加到相应的角色和小组
API 集成所需的资源
- 点击保存按钮。系统应会显示一条消息，确认已添加您的服务账号。
- 查看现有的服务账号用户，方法是转到“用户”标签页，然后
点击服务账号过滤条件。
不使用客户端库
即使您不使用客户端库，我们仍强烈建议您使用 OAuth2 库进行身份验证。
有关获取访问令牌的详细说明，请参阅
结合使用 OAuth2 和 Google API。
访问令牌
在对 API 的请求中包含您的访问令牌，方法是添加
access_token 查询参数或 Authorization HTTP 标头 Bearer 值。
尽可能使用 HTTP 标头，因为查询字符串通常会显示在服务器日志中。
例如：
GET /v1/networks/1234
Host: admanager.googleapis.com
Authorization: Bearer ya29.a0Ad52N3_shYLX
GET https://admanager.googleapis.com/v1/networks/1234?access_token=1/fFAGRNJru1FTz70BzhT3Zg
范围
每个访问令牌与一个或多个范围相关联。作用域控制着
访问令牌允许的资源和操作集。Ad Manager API 只有一个作用域。授权应由用户执行
产品内的级别
| 范围 |
权限 |
https://www.googleapis.com/auth/admanager
|
在 Google Ad Manager 中查看和管理您的广告系列。 |
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-31。
[null,null,["最后更新时间 (UTC)：2025-08-31。"],[[["\u003cp\u003eGoogle Ad Manager API authentication depends on the interface and environment but always requires an access token.\u003c/p\u003e\n"],["\u003cp\u003eChoose between service account, web application, or local development authentication based on your needs.\u003c/p\u003e\n"],["\u003cp\u003eEnable the Ad Manager API in your Google API Console and create the necessary credentials for your chosen authentication type.\u003c/p\u003e\n"],["\u003cp\u003eConfigure your Ad Manager network settings and add the service account user or enable API access depending on authentication type.\u003c/p\u003e\n"],["\u003cp\u003eInclude your access token in API requests using either a query parameter or an HTTP header.\u003c/p\u003e\n"]]],["To access the Ad Manager API, you need an access token, generated using Application Default Credentials (ADC) or custom credentials. First, enable the Ad Manager API in your Google Cloud project. Then, choose an authentication type: Service Account, Web application, or Local development. Create credentials via the Google API Console, selecting the appropriate method. If not using a client library, use an OAuth2 library. Finally, include the access token in API requests, preferably in the `Authorization` HTTP header. Each access token should be associated with the `https://www.googleapis.com/auth/admanager` scope.\n"],null,["# Authentication\n\nThis document describes how to authenticate to the Ad Manager API. How you\nauthenticate depends on the interface you use and the environment where your\ncode is running, but all API requests must include an access token with the\nAd Manager API [scope](#scope).\n\nThe Ad Manager client libraries use [Application Default Credentials](//cloud.google.com/docs/authentication/application-default-credentials)\nto generate access tokens with the Ad Manager API scope. This guide shows\nhow to configure Application Default Credentials.\n\nIf you aren't using a client library, you still need to create credentials\nand use them to authorize your requests.\n\nFor more information about authentication and authorization, see the\n[Using OAuth 2.0](/identity/protocols/oauth2) guide.\n\nDetermine your authentication type\n----------------------------------\n\n| Authentication type | Description |\n|---------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Service Account | Choose this if you want to authenticate as dedicated account rather than a particular person. [Learn more](//cloud.google.com/iam/docs/service-account-overview). |\n| Web application | Choose this if you want to authenticate as any user who grants permission to your application to access their Ad Manager data. [Learn more](/identity/oauth2/web/guides/overview) |\n| Local development | Choose this if you want to authenticate as your own Google Account or a Service Account from your local development environment. |\n\nEnable the Ad Manager API\n-------------------------\n\n1. Enable the [Ad Manager API](https://console.cloud.google.com/apis/library/admanager.googleapis.com) in your\n Google API Console Cloud Project.\n\n2. If prompted, select a project, or create a new one.\n\nCreate credentials\n------------------\n\nClick the tab for your authentication type and follow the instructions to\ncreate your credentials: \n\n### Service Account\n\n### On Google Cloud\n\nTo authenticate a workload running on Google Cloud, you use the credentials of\nthe service account attached to the compute resource where your code is\nrunning.\n\nFor example, you can attach a service account to a Compute Engine virtual\nmachine (VM) instance, a Cloud Run service, or a Dataflow job. This approach\nis the preferred authentication method for code running on a Google Cloud\ncompute resource.\n\nFor information about which resources you can attach a service account to,\nand help with attaching the service account to the resource, see the\n[documentation on attaching a service account](//cloud.google.com/iam/docs/attach-service-accounts).\n\n### On-premises or on a different cloud provider\n\nThe preferred method to set up authentication from outside of Google Cloud is\nto use [workload identity federation](//cloud.google.com/iam/docs/workload-identity-federation); you create a\ncredential configuration file and set the `GOOGLE_APPLICATION_CREDENTIALS`\nenvironment variable to point to it. This approach is more secure than\ncreating a service account key.\n\nIf you are not able to configure workload identity federation, then you must\ncreate a service account and create a key for the service account:\n\n1. Open the [Google API Console Credentials page](https://console.cloud.google.com/apis/credentials).\n\n2. On the Credentials page, select **Create credentials** , then\n select **Service Account**.\n\n3. Click the email address of the service account that you want to create\n a key for.\n\n4. Click the **Keys** tab.\n\n5. Click the **Add key** drop-down menu, then select **Create new key**.\n\n6. Select **JSON** as the **Key type** and click **Create**.\n\n7. Set the environment variable `GOOGLE_APPLICATION_CREDENTIALS` to the path\n of the JSON file.\n\n#### Linux or macOS\n\n export GOOGLE_APPLICATION_CREDENTIALS=\u003cvar label=\"key file\" translate=\"no\"\u003eKEY_FILE_PATH\u003c/var\u003e\n\n#### Windows\n\n set GOOGLE_APPLICATION_CREDENTIALS=\u003cvar label=\"key file\" translate=\"no\"\u003eKEY_FILE_PATH\u003c/var\u003e\n\n### Web application\n\n1. Open the [Google API Console Credentials page](https://console.cloud.google.com/apis/credentials).\n\n2. If prompted, select the project where you enabled the Ad Manager API.\n\n3. On the Credentials page, select **Create credentials** , then\n select **OAuth client ID**.\n\n4. Select the **Web application** application type.\n\n5. Fill in the form and click **Create** . Applications that use languages and\n frameworks like PHP, Java, Python, Ruby, and .NET must specify authorized\n **redirect URIs** . The redirect URIs are the endpoints to which the OAuth 2.0\n server can send responses. These endpoints must adhere to [Google's\n validation rules](/identity/protocols/oauth2/web-server#uri-validation).\n\n6. After creating your credentials, download the **client_secret.json** file. Securely store the file in a location that only your application can access.\n\nFrom here, follow the steps to [obtain OAuth 2.0 access tokens](/identity/protocols/oauth2/web-server#obtainingaccesstokens)\n\n### Local development\n\nSet up Application Default Credentials (ADC) in your local environment.\n\nInstall the Google Cloud CLI, then initialize it by running the following\ncommand: \n\n gcloud init\n\nCreate local authentication credentials for your Google Account and set\nthe project ID to a project where the Ad Manager API is enabled: \n\n gcloud auth application-default login --scopes=\"https://www.googleapis.com/auth/admanager\"\n gcloud auth application-default set-quota-project \u003cvar label=\"project id\" translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\nAlternatively, authenticate as a Service Account setting the environment\nvariable `GOOGLE_APPLICATION_CREDENTIALS` to the path of your key file.\n\n#### Linux or macOS\n\n export GOOGLE_APPLICATION_CREDENTIALS=\u003cvar label=\"key file\" translate=\"no\"\u003eKEY_FILE_PATH\u003c/var\u003e\n\n#### Windows\n\n set GOOGLE_APPLICATION_CREDENTIALS=\u003cvar label=\"key file\" translate=\"no\"\u003eKEY_FILE_PATH\u003c/var\u003e\n\nConfigure your Ad Manager network\n---------------------------------\n\n**Tip:** If you are a third-party developer, ask your client to complete this step for you. Send them to [Add a service account user for API access](//support.google.com/admanager/answer/6078734) and provide the email address of your service account. \n\n### Service Account\n\n1. Go to your [Ad Manager network](//admanager.google.com).\n2. Click the **Admin** tab.\n3. Ensure that **API access** is enabled.\n4. Click the **Add a service account user** button.\n5. Fill in the form using the service account email. The service account user must be added to appropriate roles and teams for your API integration.\n6. Click the **Save** button. A message should appear, confirming the addition of your service account.\n7. View existing service account users by going to the Users tab and then clicking the **Service Account** filter.\n\n### Web application\n\n1. Go to your [Ad Manager network](//admanager.google.com).\n2. Click the **Admin** tab.\n3. Ensure that **API access** is enabled.\n\n### Local Development\n\n1. Go to your [Ad Manager network](//admanager.google.com).\n2. Click the **Admin** tab.\n3. Ensure that **API access** is enabled.\n\nWithout a client library\n------------------------\n\nIf you are not using a client library, we still strongly recommend using\nan OAuth2 library for authentication.\n\nFor detailed instructions on obtaining access tokens, see\n[Using OAuth2 with Google APIs](/identity/protocols/oauth2).\n\n### Access tokens\n\nInclude your access token in a request to the API by including either an\n`access_token` query parameter or an `Authorization` HTTP header `Bearer` value.\nWhen possible, the HTTP header is preferable, because query strings tend to be\nvisible in server logs.\n\nFor example: \n\n GET /v1/networks/1234\n Host: admanager.googleapis.com\n Authorization: Bearer ya29.a0Ad52N3_shYLX\n\n GET https://admanager.googleapis.com/v1/networks/1234?access_token=1/fFAGRNJru1FTz70BzhT3Zg\n\n### Scope\n\nEach access token is associated with one or more scopes. A scope controls the\nset of resources and operations that an access token permits. The Ad Manager\nAPI has only one scope. Authorization should be performed at the user\nlevel within the product.\n\n| Scope | Permissions |\n|---------------------------------------------|------------------------------------------------------|\n| `https://www.googleapis.com/auth/admanager` | View and manage your campaigns on Google Ad Manager. |"]]
