Google Ad Manager access Apostra needs

When you connect Google Ad Manager (GAM), Apostra runs a sales agent in front of your network for you. It signs in to GAM as a service account that Apostra creates for your organization, and you give that service account a role in your network. This page says what the role must allow, what Apostra uses each permission for, what stops working without it, and what you give up if you grant less. To get the service account’s email and connect the network, see Connecting an ad server.

​

The short answer

Apostra recommends the built-in Administrator role. That is a recommendation, not a check. Apostra works with any role that can do everything in the list below, and GAM does not tell Apostra what a custom role allows. A custom role works if it lets the service account:

• read ad units, placements, labels and audience segments;
• read, create, edit and archive orders and line items, and pause, resume and release line items;
• approve orders, and approve orders that overbook if you sell guaranteed inventory;
• create creatives and attach them to line items;
• read custom targeting keys and values, and add values to free-form keys;
• read advertisers, and create them if you want Apostra to create advertisers for you;
• run reports and read forecasts.

The service account must also be able to see your advertisers. If your network uses teams, add it to a team that includes them, or to a team with All entities. Do not use the built-in Trafficker role: it cannot approve orders. Neither can Salesperson, Executive, Advertiser, Legal manager or Ad Exchange manager. Apostra never needs to manage your GAM users, roles or teams, change your network or billing settings, or create or change your ad units and placements.

​

Adding the service account

You add a service account in GAM through API access in your network’s global settings, with Add a service account user. API access must be turned on. Do not add it as a new user on the Users page: that sends an email invitation, and a service account has no inbox to accept it. Once it is added, the service account’s email appears in your users list as an active user. GAM’s menu names change, so follow Google’s own help for the exact path. The person who adds the service account needs rights in GAM to add users and assign roles. You can remove the service account at any time, and Apostra’s access stops.

​

What each permission is for

Apostra also reads your network’s time zone and currency, and the service account’s own GAM user and role.

​

Checks Apostra runs

GAM tells Apostra the service account’s role name, but not what a role allows. So Apostra learns about a missing permission in two ways: from a small read that needs it, or from GAM refusing a real action.

​

Order approval

Apostra approves each order once its line items and creatives are in place. When GAM refuses, the order stays in draft and the buy waits. It does not deliver until the order is approved. Apostra finds this before the first buy if the service account has one of the six built-in roles that cannot approve orders. It reads the role when you connect and each time you run Test connection on the ad-server source page. A custom role cannot be judged from its name, so Apostra finds a custom role that cannot approve the first time GAM refuses an approval. While the problem stands:

• your setup checklist shows Ad-server order approval, and the source’s diagnostics name your GAM network;
• held buys show on your Media Buys list as Held in your ad server, because its user can’t approve orders;
• a new listing on Apostra is refused, with the fix. Existing listings stay listed, and you can always unlist them.

Three things cause it: the role cannot approve orders, the role can approve but not overbook and the order exceeds the forecast, or your network routes orders through an approval workflow that does not include the service account. To fix it, give the service account the Administrator role or a custom role that can approve orders (and overbook, if you sell guaranteed inventory), or add it as an approver in your order approval workflow. Until then, you can approve each held order in GAM yourself, and the buy moves on once GAM shows the order approved. If the warning came from the role name, run Test connection after changing the role. If it came from a refused approval, it clears the next time GAM accepts an approval from the service account. Approving orders in GAM is separate from your own review of buyers’ media buys and creatives in Apostra. Changing one does not change the other.

​

Reporting access

Apostra checks reporting access by running a one-day report about once a day. If GAM refuses, the source’s diagnostics show that reporting access is missing and when it was last checked. Without reporting access:

• delivery reports for buys on this source are incomplete;
• Apostra cannot price products from your delivery history, so you keep prices current yourself with a wholesale pricing feed or fixed prices;
• Apostra does not optimize placement, and delivery goals are yours to manage.

Inventory, orders and selling are not affected today. Apostra has decided that a seller on a source it manages will need its delivery to reach Apostra automatically before it can sell, either through GAM reports or through a reporting connection the seller provides. That is not enforced yet. To fix it, give the service account’s role permission to run reports. The next daily check picks it up. To resume reporting at once, choose Access confirmed - re-check reporting on the diagnosis.

​

Advertiser team access

GAM shows a user only the advertisers on its teams. A service account that authenticates but is on no team with advertisers sees an empty advertiser list, which looks the same as a network with no advertisers. When GAM returns no advertisers and your network uses teams, Apostra checks the service account’s teams. If none of them gives it access to all advertisers, the advertiser sync fails and the source shows an access problem to fix in GAM. Apostra keeps the advertiser list it had, rather than treating your advertisers as gone. To fix it, add the service account to a team that includes your advertisers, or to a team with All entities, then refresh the source.

​

Granting less than Administrator

You can grant less. Each permission you leave out has a cost, in the table above. In short: You cannot leave out reading inventory, reading and writing orders and line items, creatives, or reading custom targeting. Without them, Apostra cannot book a buy.

​

Related