A WordPress Data Manager integration can authenticate successfully but still lack permission to use the intended Google Ads, Analytics, or other destination. Service account impersonation, API scopes, IAM roles, and destination account access must be configured as one path.
Use this for server-side WordPress conversion uploads, agency integrations, scheduled jobs, and plugins that send first-party data to the Data Manager API.
Quick answer
Data Manager API Service Account Access for WordPress should be handled with a narrow evidence-first workflow: enable api, configure impersonation, grant narrow roles, then verify the result before making broader changes.
What to check first
- Use a dedicated Google Cloud project and enable the Data Manager API.
- Prefer service account impersonation over downloaded long-lived service account keys.
- Grant the required Service Usage Consumer and token creation permissions narrowly.
- Configure ADC with the Data Manager scope and grant the service account access to the destination.
- Run a validate-only request and record the operating account, destination, and authorization result.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Enable API | Use a dedicated Google Cloud project and enable the Data Manager API. | ADC returns a token with the required Data Manager scope. |
| Configure impersonation | Prefer service account impersonation over downloaded long-lived service account keys. | The service account can access only the intended destination accounts. |
| Grant narrow roles | Grant the required Service Usage Consumer and token creation permissions narrowly. | A validate-only request succeeds without uploading production data. |
| Add destination access | Configure ADC with the Data Manager scope and grant the service account access to the destination. | No long-lived credential is stored in the database, repository, or public plugin settings. |
Why this usually happens
- Cloud IAM permission and destination account access are separate controls.
- A token can be valid while missing the Data Manager scope.
- Long-lived JSON keys are often copied into WordPress config or plugin settings without rotation.
- Agency manager access does not automatically grant every service account access.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
gcloud auth application-default login \
--impersonate-service-account=SERVICE_ACCOUNT_EMAIL \
--scopes='https://www.googleapis.com/auth/datamanager,https://www.googleapis.com/auth/cloud-platform'
gcloud auth application-default print-access-token --scopes='https://www.googleapis.com/auth/datamanager'
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Enable API
- Configure impersonation
- Grant narrow roles
- Add destination access
- Validate request
What to tell the client or owner
Document the project, service account, scopes, IAM roles, destination access, secret location, rotation owner, and validate-only result.
Production verification checklist
- ADC returns a token with the required Data Manager scope.
- The service account can access only the intended destination accounts.
- A validate-only request succeeds without uploading production data.
- No long-lived credential is stored in the database, repository, or public plugin settings.
Mistakes to avoid
- Do not judge the fix by one browser or the homepage only.
- Do not delete evidence before recording usernames, file paths, timestamps, and response headers.
- Do not add a cache, security, or tracking plugin while the original problem is still unclear.
- Do not leave test users, temporary debug logs, or broad API keys active after verification.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, malware risk, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, build a safer WordPress conversion upload path.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references