Share via

I can't connect sandbox Ads via API (Forbidden https://login.windows-ppe.net/)

Zorion 10 Reputation points
2025-05-19T12:29:23.8866667+00:00

Until last Friday I was able to access my Sandbox MsAds account via API (in python).

Now it fails because I need to refresh the credentials and I can't access the login page (it returns a 403 Forbidden):

The Python library gives me this URL:

https://login.windows-ppe.net/consumers/oauth2/v2.0/authorize?client_id=...&scope=https://api.ads.microsoft.com/msads.manage%20offline_access&response_type=code&redirect_uri=....&prompt=login

It gives me a direct error 403, so I can't continue. Should I change something?

I'm using the following library:

Name: bingads
Version: 13.0.14

Thanks in advance!

EDIT: For your information. We think that windows-ppe has been deprecated so we updated the library and tried to use an "outlook" account (instead of an "outlook-int" account), but we still haven't managed to authenticate properly (see replies to Julian Selser's comments).

Microsoft Advertising API
Microsoft Advertising API

A Microsoft API that provides programmatic access to Microsoft Advertising to manage large campaigns or to integrate your marketing with other in-house systems.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Julian Selser 20 Reputation points
    2025-05-20T16:52:08.1266667+00:00

    Im in the same boat since last week...

    2 people found this answer helpful.
  2. Zorion 10 Reputation points
    2026-02-24T08:51:50.2866667+00:00

    Finally I got it!

    I am using the Python library. I had to update to v13.0.26 because older versions required me to keep a deprecated setuptools. So that may be part of the solution.

    I used a real "@outlook.com" account to access my sandbox account (you may need to create a new sandbox account if you don't have access).

    I had to create a new App Registration in Azure Entra ID, because the relevant part was WHO may access, and you need to select the third option (Under Supported account types, you must select the third option: Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox).). I did it in our production Azure Entra ID, I just named the App Registration "Sandbox BingAds API" or similar.

    Then you will need to create a secret so you use its value in your setup (you know, like before you need the well known token, the client_id you created (the new app registration) and the client secret you just created.

    Lucky me, I had access to my sandbox using an outlook account, so I was able to create the tokens and I accessed via API my sandbox system.

    I hope that help others.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.