Google rejects applications for developer tokens

[zestyping]

This is not a software bug, but a different kind of problem.

Expected Behavior

I followed the procedure described in the documentation for setting up a Google AdWords integration, hoping to get a developer token to use with Airbyte.

Current Behavior

Unfortunately, Google rejected my application with the following message:

Dear API Applicant,

Thank you for submitting an application to the AdWords API. Unfortunately, the application you submitted was rejected due to the following:

It appears that you are planning on using a third-party tool (AirByte) with an AdWords API token. This is a violation of the Ads API Policies, and is not a permissible use case for API access.

Please feel free to contact the third party tool provider and encourage them to apply for their own token.

If you have any questions or feel we have reached this decision in error, you may contact us here.

Sincerely,
The Google Ads API Compliance Team

Severity of the bug for you

Critical. If we can't use Airbyte with Google AdWords, we can't use Airbyte. :(

[michel-tricot]

@sherifnada I think we should give an example of message to write in the documentation to have a successful application.

[zestyping]

Here's what I wrote in response to their rejection. Fingers crossed!

I'm writing in regard to our request T69-60712875 for a developer token, which was rejected for the following reason:

"It appears that you are planning on using a third-party tool (AirByte) with an AdWords API token. This is a violation of the Ads API Policies, and is not a permissible use case for API access."

We are not planning to use Airbyte as a hosted service. We will host our own servers, using the Airbyte open source software to transfer our own data into our own data warehouse, as part of tools that we are building for ourselves. No external organization will ever see our API key or indirectly exercise our API key.

I hope this makes it clear that our use of the token will be in compliance with the Google Ads API policy. Would you please review our request and grant the token?

[sherifnada]

Thanks for the sample @zestyping -- we'll update our docs.

[zestyping]

Don't act too soon—they rejected my appeal just now. 😢

Thanks for reaching out.

Please note that we do not reject all 3rd party tools as a rule, we review every 3rd party tool independently and make our decisions on a case by case basis. Airbyte requiring users to apply for their own devtoken to use their 3rd party software is a direct violation of our Ads API Policies. Airbyte should have its own API token and all you have to do is sign in with your AdWords account.

[sherifnada]

For this process to work reliably for users, we'll need to get whitelisted by Google.

@johnlafleur is reaching out to some connections to understand how to go through the process.

[johnlafleur]

Unfortunately, it seems they got through the process for Gmail, but not for Google Ads.

[cgardens]

Action Items:

• Reach out to google directly
• Provide a more reliable text that will be accepted

[sherifnada]

update: I've submitted a support request with Google to address this problem.

[sherifnada]

Submitted another request to the Google Adwords API compliance team per the instructions given to me by support

[sherifnada]

Response from Google:

Thank you for your patience.
Unfortunately, The requirement for that developers to obtain a Google Ads API token as a prerequisite to integrating with AirByte is a violation of our policies.
Since your developer clients they do not own the AirByte software, AirByte should be managing API calls through its own dev token and hence any policy violations, rate limits or other issues have to be resolved by AirByte.
Feel free to let us know if you have any questions.

It sounds like the main issue is that they want to be able to resolve any issues to Airbyte directly. For example, if our connector hammers the API with rate limiting but company XYZ is the one running that connector, they want to be able to reach out to us directly asking us to fix the problem, not to XYZ.

Will follow up with them seeing what a middle ground here can be.

[sherifnada]

My email to Google:

Hi Ryan,
Thank you for your prompt response.
Airbyte is MIT-licensed, which means a user of Airbyte owns the copy of Airbyte they are using and can modify it however they need. While Airbyte builds its connectors in compliance with rate limiting, best practices etc.. a user could edit that version of Airbyte (for example to add a feature that they need) and in doing so violate best practices around rate limiting. In this case, Google will actually want to reach out to the user, not to Airbyte, because they are the ones that ultimately control the behavior of the software. Using Airbyte is like using code that was downloaded from the internet: the minute a user downloads it, Airbyte can no longer control it, and the user can (and is expected to) edit it to fit their needs.
It's also important to note that the usage pattern described in your email (users of Airbyte use Airbyte's API token) is also in violation of the "Allowing automated use of your API token" section of the policy: because the software is open source, we would have to physically share our developer token with every user of Airbyte. This would make it impossible for us to control access to the token, and it would be very easy for it to leak. This would make it trivial to impersonate Airbyte as an API client, and ultimately defeats Google's goal of tracking down issues to the entity that caused them like you mention (" issues have to be resolved by AirByte").
In light of this information, would you please reconsider the original request to whitelist Airbyte when a user requests a developer token?

Their response:

After further discussion of your situation with our product teams, we are unable to grant your request for a developer token to be used with a third-party tool you do not own or manage.
A developer token is a means to enable your application to connect to the Google Ads API. This token must belong to and be managed by the developer responsible for building and maintaining the codebase of the app. You should not share your dev token with another entity whose codebase you don’t manage. Additionally you should not build your app in a manner that requires clients to obtain a developer token for it to be used.
Unfortunately we are unable to modify this policy and must apply it consistently across our developers.

[johnlafleur]

Can you confirm that they accept Singer?

…

On Sat, Mar 6, 2021 at 7:16 AM Sherif A. Nada ***@***.***> wrote: My email to Google: Hi Ryan, Thank you for your prompt response. Airbyte is MIT-licensed, which means a user of Airbyte owns the copy of Airbyte they are using and can modify it however they need. While Airbyte builds its connectors in compliance with rate limiting, best practices etc.. a user could edit that version of Airbyte (for example to add a feature that they need) and in doing so violate best practices around rate limiting. In this case, Google will actually want to reach out to the user, not to Airbyte, because they are the ones that ultimately control the behavior of the software. Using Airbyte is like using code that was downloaded from the internet: the minute a user downloads it, Airbyte can no longer control it, and the user can (and is expected to) edit it to fit their needs. It's also important to note that the usage pattern described in your email (users of Airbyte use Airbyte's API token) is also in violation of the "Allowing automated use of your API token" section of the policy: because the software is open source, we would have to physically share our developer token with every user of Airbyte. This would make it impossible for us to control access to the token, and it would be very easy for it to leak. This would make it trivial to impersonate Airbyte as an API client, and ultimately defeats Google's goal of tracking down issues to the entity that caused them like you mention (" issues have to be resolved by AirByte"). In light of this information, would you please reconsider the original request to whitelist Airbyte when a user requests a developer token? Their response: After further discussion of your situation with our product teams, we are unable to grant your request for a developer token to be used with a third-party tool you do not own or manage. A developer token is a means to enable your application to connect to the Google Ads API. This token must belong to and be managed by the developer responsible for building and maintaining the codebase of the app. You should not share your dev token with another entity whose codebase you don’t manage. Additionally you should not build your app in a manner that requires clients to obtain a developer token for it to be used. Unfortunately we are unable to modify this policy and must apply it consistently across our developers. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1981 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AQLCVQUCQXXTTS73H76JBS3TCE3ZZANCNFSM4XFJUT7Q> .

[sherifnada]

My response:

Hi Ryan,
My concern is that the course of action you are recommending (having users of Airbyte use Airbyte’s dev token) is not possible at a technical level without violating Google’s policy and getting us banned.
Users of Airbyte both own and manage the software they are using and so should be allowed to use their own dev token. However their applications for airbyte tokens are currently being rejected.
How can we move forward with supporting AdWords API?

Their response:

Dear Developer,
Thanks for your patience.
The requirement for that developers to obtain a Google Ads API token as a prerequisite to integrating with AirByte is a violation of our policies. Unfortunately we are unable to modify this policy and must apply it consistently across our developers.
Please note that we do have applicants that builded software related to Google Ads for the general public or their clients. And their clients are not required to obtain a developer token. If you have any technical questions related to Google Ads. We would suggest you reach out to our technical support team at adwordsapi-support@google.com with your issue on a separate thread or consult the AdWords API developer forum.

[sherifnada]

The saga continues. Google said Singer is OK so i'm trying to understand how Airbyte is different

[michel-tricot]

I think we will get some definitive answer soon.

In the meantime, I got an possible explanation:

I just heard back from one of my gTech colleagues with a possible cause for what you're describing. Essentially, anyone can create a developer token to use the Google Ads API. However, the policy is to create only one per company. So what could be happening, is that the Google Token grantors think your clients are all part of Airbyte causing the request to get denied since a token for Airbyte likely already exists. You could consider instructing your clients to request their token without mentioning Airbyte to possibly avoid that confusion.

[sherifnada]

stopgap docs: #2628

[michel-tricot]

Just got the confirmation that Google whitelisted Airbyte!

Moving forward, the product team have decided to allow exceptions if developer applying for a dev token can confirm that they are able to modify the codebase interacting with the API and have access to the server running the code.

I will update the documentation accordingly tomorrow

[zestyping]

Fabulous! Congratulations! —Ping

…

On Thu, Apr 15, 2021, 19:15 Michel Tricot ***@***.***> wrote: Just got the confirmation that Google whitelisted Airbyte! Moving forward, the product team have decided to allow exceptions if developer applying for a dev token can confirm that they are able to modify the codebase interacting with the API and have access to the server running the code. I will update the documentation accordingly tomorrow — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1981 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABZUNQLLU6WXFZDLHCTUO3TI6MSZANCNFSM4XFJUT7Q> .

[Rachel-Norris]

I'm currently trying to get this set up as well and running into similar issues.
I've followed your advice above (which was really helpful) but I'm now being asked to send a design document. Has anyone successfully done this for google ads, and if so what design doc did you use?

@zestyping @michel-tricot

[LauraC91]

@Rachel-Norris I'm at the exactly the same step, have you solved with the design document

[cgardens]

@sherifnada @andyjih @Amruta-Ranade any guidance here on design document?

[Amruta-Ranade]

Do we have any previously accepted design docs or is this a new requirement? If it's the latter, can we find out what exactly Google's asking for?

[misteryeo]

Sounds like it's a new requirement @Rachel-Norris - are you able to share what's being requested to be included in the design doc?

[cgardens]

If I recall they have always asked for a design document. I'm not sure if we have one that we've provided as guidance for community members in the past though or not.

[ThomasDAdams]

They are requesting a design document. Please can we have one provided to us?

[Rachel-Norris]

Hey @misteryeo and @LauraC91, I asked for more information about the design doc and they just sent me this example. However in the end, I decided to use the cloud version as I was running into similar issues with other APIs access requests as well and it was taking up a lot of time.

Hopefully this helps and let me know if you get anywhere

[KleyLimaa]

Any updates about the design docs?

[vincent-el]

was able to use the above example by @Rachel-Norris successfully for Basic Access, giving just the most basic info about Airbyte & our use-case

GoogleAds team came back to me with a couple of questions over several mails, so make sure to answer those directly if you can:

Could you please confirm whether this request is for[ App Conversions and Remarketing API](https://developers.google.com/app-conversion-tracking/api/) or[ Google Ads API](https://developers.google.com/google-ads/api/docs/start)?
-> Google Ads API

1) In using your developer token with Airbyte, do you have the ability to modify the code base that is interacting with the API?
-> yes, because Airbyte is open source https://github.com/airbytehq/airbyte

 2) In using your developer token with Airbyte, do you have access to the server that is running the code?
-> yes, because we are self hosting Airbyte in our own VPC


You did not include enough information as to what type of API calls you will be making. Specifically, you must clarify which of the following calls you plan on making 1) Reporting 2) Creation/management 3) KeywordPlanIdeaService or KeywordPlanService.
-> Regarding the information that we did not include, we apologize for the oversight. We plan on making Reporting API calls in order to obtain as much ad data as possible for ingestion into our data warehouse.

[KleyLimaa]

@vincent-el Thank you very much for the reply. This was basically what I fill except for the third item. Thanks for the advice.

[nick-potts]

Has anyone gone through this process recently? I've been waiting over two months for approval. I got an email about 2 weeks ago with similar questions to Vincent, but nothing since.