Unity Ads API 403 Invalid Credentials: how to fix it

A Unity service account key can authenticate and still get a 403 with an Invalid Credentials message on every request. In Unity’s docs, the cause is a missing organization role on the service account. Assign the role for each job your tool does, then retry.

Why a valid key still returns 403

According to Unity’s page on locating advertiser credentials, a service account with no role can still authenticate, but every request it makes fails with a 403 error and an Invalid Credentials message. Each role grants one permission, so you must assign a role before you use the credentials.

Unity’s What’s new in User Acquisition page lists the same rule under September 2026: after you generate a key, you must assign an organization role to the service account.

The message names credentials, so it sends you looking at the key. In the case Unity describes, the key authenticates and the account has no permission for what you asked.

Which role you need for each job

Unity groups the roles under the User Acquisition category. This is how the credentials page maps them to jobs:

Job	Role	Covers
Reporting	Advertise Stats API Viewer	/reports/acquisitions, /reports/skan
MMP integration	Advertise Stats API MMP Viewer	/reports/mmp
Campaign management	Advertise API roles	Apps, Bids, Budgets, Campaigns, Creative packs, Targeting

For campaign management, Unity’s What’s new page says you need an Advertise API role for each resource you manage, such as apps, bids or campaigns. A script that manages apps, campaigns and bids touches three resources, so it needs the matching role for each of the three.

The credentials page also says that a request for a resource your service account has no role for fails with a 403, even when requests for other resources succeed. If reads work and one write fails, compare the failing resource with the roles on the account.

Who can create keys

The credentials page says only Organization Owners or Organization Managers can create service accounts and secret keys. If you are not one of them, ask one to create the key and to check the account’s organization roles.

The path in the dashboard:

1. Open Settings > API management.
2. Open Service account from either API card.
3. Pick the account, or select + New.
4. In the Keys section, select + Add key. You get a Key ID and a Secret key.

Roles are assigned separately. In the Organization roles section, select + Manage organization roles and pick the roles under the User Acquisition category.

The secret key is shown once

The dashboard displays the Secret key only once, and you can’t view previously generated keys. Store the Key ID and the Secret key together somewhere secure. If you lose the Secret key, you must create a new key.

Roles are assigned to the service account, not to a single key. Our reading is that a new key on the same account falls under the same role assignment. The docs we read don’t spell this out, so check the roles after you add a key.

Checklist: what to check, in order

1. Confirm who creates keys in your org: an Organization Owner or Manager.
2. Open Settings > API management, then Service account, and pick the account your key belongs to.
3. Look at its organization roles in the User Acquisition category. No roles means every request returns 403.
4. List what your tool calls: reports, MMP data, or campaign resources such as apps, bids, budgets, campaigns, creative packs and targeting.
5. Match each call to a role from the table above. Add what is missing.
6. Retry the failing request. If other resources work and only this one fails, the missing role is for this resource.
7. If you no longer have the Secret key, create a new key and store the Key ID and Secret key together.
8. Only after the roles are correct, look at the request itself: path, base URL and body.

After you move to the Advertiser Public API

If your key worked on the old API and now returns 403, roles are the first place to look. Unity’s Advertiser API migration reference says HTTP Basic still works and the credential is unchanged, but the required roles and permissions differ. It adds that a 403 with the same credential is a missing role grant, not a request bug.

The rest of the change (new base URL, app ids, microdollars) is in what changed in the Unity Advertiser Public API.

Doing this in DarkCore Ramet

In DarkCore Ramet you connect a Unity org with a service account key or with your own Unity ID. The key and its roles come from your Unity dashboard. Once the org is connected, bulk launch sends campaigns through the official Unity API, and each change is read back from Unity and logged with who made it.

What the docs don’t say

The credentials page does not show a request example or the header format. It does not say whether you can rotate a key in place, whether older keys stop working when you add a new one, or whether keys expire. It also does not list the exact permissions inside each Advertise API role. The role list names Creative packs but not creatives, so we cannot tell you which role covers creative uploads.