Articles in this section

By Unwired Logic  -  a prerequisite for any integration that uploads conversions to Google Ads

You'll need:  a Google account, and admin access to your Google Ads account

About This Guide

To upload conversions into your Google Ads account, an integration needs permission to write to that account. That permission comes from a Google service account - a machine credential you create once in Google Cloud and then add as a user on your Google Ads account, exactly like you would add a colleague.

This guide walks through those three one-time steps. At the end you'll have a JSON key file to paste into whichever integration you are connecting.

The steps are the same whatever system your conversions come from - a property or storage management system, a CRM, a helpdesk, or your own application. Only the final step, where you paste the key, differs from product to product; see What to Do Next.

It takes about 10 minutes, and it is free - creating a Google Cloud project and a service account costs nothing, and conversion uploads stay inside Google's free tier.

Before You Start

Uploads go through Google's Data Manager API, using the service account you add directly to your own Google Ads account.

Have these ready:

  • A Google account that can sign in to console.cloud.google.com. Any Google account works - a company Workspace account is preferable to a personal one, so the credential survives staff changes.
  • Admin access to the Google Ads account that runs your ads, so you can add a user to it in step 3.
⚠️  Use the Google Ads account that actually runs the ads. The service account must be added to the same Google Ads account whose Customer ID you give the integration. If you have several Google Ads accounts, pick the one the campaigns actually run in.

Note - one service account can serve several integrations: If you have already created a service account for another Unwired Logic integration on the same Google Ads account, you can reuse it - create a fresh JSON key for the new integration rather than repeating all three steps. Separate keys let you revoke one integration's access without disturbing the others.

 

1.  Create a Google Cloud Project and Enable the Data Manager API

The Cloud project is just a container for the credential. It doesn't host anything and it isn't billed.

  1. Go to the Google Cloud Console and click Select a project > New Project. Give it a name that identifies both the owner and the purpose, so it's easy to recognise later - e.g. <your-company>-ads-conversions (lowercase, words separated by hyphens). Click Create.

     

     

  2. With the new project selected, open APIs & Services > Library, search for Data Manager API, open it, and click Enable.

Note - check the project selector: The Cloud Console remembers the last project you had open. After creating the project, confirm its name is showing in the selector at the top of the page before you enable the API - otherwise you'll enable it on the wrong project and the credential won't work.

 

2.  Create a Service Account and Download Its Key

  1. In the Cloud Console, open IAM & Admin > Service Accounts and click Create Service Account. Enter a name that identifies its purpose, so it's easy to recognise later - e.g. ads-conversion-uploader (lowercase, words separated by hyphens). Click Create and continue, then Done (no project roles are needed).

     

  2. Open the new service account, go to the Keys tab, and click Add Key > Create new key. Choose JSON and click Create - a JSON key file downloads to your computer.

Why no project roles: The service account needs no permissions inside Google Cloud. Its only permission is the one you grant in step 3, on your Google Ads account.

Treat the JSON key file like a password. It is downloaded only once - Google cannot show it to you again - and anyone holding it can act as this service account. Store it in your password manager, not in email or chat. If it is ever exposed, delete the key on the Keys tab and create a new one; the old key stops working immediately.

The file looks like the example below. You will paste the whole file into your integration later, and you'll need the client_email value in step 3:

{
  "type": "service_account",
  "project_id": "acme-ads-conversions",
  "private_key_id": "a1b2c3...",
  "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
  "client_email": "ads-conversion-uploader@acme-ads-conversions.iam.gserviceaccount.com",
  "client_id": "1234567890",
  ...
}

 

3.  Add the Service Account to Your Google Ads Account

Creating the service account gives it an identity, not access. This step grants it permission to upload conversions to your Google Ads account.

  1. Copy the service account's email from the JSON file - the client_email value, format xxx@xxx.iam.gserviceaccount.com.

  2. In your Google Ads account, go to Admin > Access and security, click + to add a user, paste the service account email, and choose an access level that allows uploading conversions (Standard or Admin).

  3. Send the invitation. A service account is added without needing to accept an email, so access takes effect immediately.

Note - it may appear as pending: Google Ads lists the service account under the same "pending invitation" flow it uses for people. That is cosmetic - a service account cannot open an email, and the access is already live. Don't wait for it to change state.

 

What to Do Next

You now have the credential. Go back to the setup guide for the integration you are connecting and paste in:

  • The service account JSON - the entire key file from step 2. Unwired Logic integrations store it encrypted at rest (AWS KMS).
  • Your Google Ads Customer ID - the account you added the service account to in step 3, usually shown in Google Ads in the XXX-XXX-XXXX form.

Most integrations also need some Google-side setup before conversions will register - typically a conversion action of type offline / API upload for each event you want to track, a utm_source on your campaign landing URLs, and enhanced conversions turned on with the customer-data terms accepted. Your integration's own guide covers those; for example:

If you're not sure which guide applies to you, email support@unwiredlogic.com and we'll point you to it.

 

Troubleshooting

Uploads fail with a permission or authentication error

  • Check the Data Manager API is enabled on the same Cloud project the service account belongs to (step 1). The project_id in the JSON file tells you which project that is.
  • Check the service account's client_email appears under Admin > Access and security on the Google Ads account whose Customer ID you entered - not on a different Google Ads account.
  • Check its access level is Standard or Admin. Read-only and billing-only levels cannot upload conversions.

 

I lost the JSON key file

It can't be recovered - Google only ever shows it once. Create a replacement: open the service account > Keys tab > Add Key > Create new key > JSON, paste the new file into your integration, then delete the old key from the same tab. You do not need to redo step 3 - the service account and its Google Ads access are unchanged.

 

How do I revoke access later?

Either remove the service account from your Google Ads account's users (Admin > Access and security), or disable or delete the key in Google Cloud. Either one stops uploads immediately. Unwired Logic integrations use this access only to upload conversion events to your account - never to read your campaigns or change settings.

 

Still stuck?

Email support@unwiredlogic.com with the error you're seeing and the service account email (never the key file itself) and we'll take a look.

 

Unwired Logic     info@unwiredlogic.com

Related articles

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk