Code 105 InvalidCredentials error despite correct OAuth and Developer Token

Hello Linn Ivstam,

Thank you for using our Microsoft Advertising Learn Q&A Platform!

I understand it can be frustrating when Error Code 105 (InvalidCredentials) shows up even though every credential looks correct. The good news is that this error almost always comes from one of a few very specific Microsoft Advertising SOAP requirements and they’re not obvious from the OAuth flow alone.

Below is a clear breakdown of what typically causes this, why it happens, and how to fix it.

Microsoft Advertising returns InvalidCredentials when any of the following SOAP header elements do not match what the backend expects:

• DeveloperToken
• AuthenticationToken (your OAuth access token)
• CustomerId
• AccountId
• UserId (optional but sometimes required depending on the call)

Even if your OAuth token is valid, the SOAP layer still enforces additional identity checks that differ from the REST APIs.

The Most Common Hidden Causes

1. Your Microsoft Entra app must request “ads.manage” or “ads.read” scopes specifically for Microsoft Advertising. If the token was issued for a different resource (e.g., Graph), SOAP will reject it with Error 105.

Check your token’s aud claim, it must be:

__https://ads.microsoft.com

__If it’s not, the SOAP API will always return InvalidCredentials.

2. Even if the user is a “Super Admin” in Entra ID, Microsoft Advertising is a separate identity system.

The user must:

• Exist in Microsoft Advertising
• Have access to the CustomerId and AccountId you are passing
• Be active (not pending invitation)

If the user is not mapped to the Microsoft Advertising account hierarchy, SOAP returns Error 105.

3. A developer token can be:

• Active
• Approved for production
• But still not authorized for a specific customer

This happens often when:

• The developer token belongs to a different Microsoft Advertising manager account
• The CustomerId you are calling is not under that manager

SOAP requires the developer token to be tied to the same hierarchy.

4. SOAP requires all of these headers:

• DeveloperToken
• AuthenticationToken
• CustomerId
• AccountId

Example of a correct header block: soap:Header

  <AuthenticationToken>ACCESS_TOKEN</AuthenticationToken>

  <DeveloperToken>DEV_TOKEN</DeveloperToken>

  <CustomerId>12345678</CustomerId>

  <AccountId>98765432</AccountId>

</soap:Header> If any are missing or empty, you get Error 105.

5. For Customer Management, the correct production endpoint is: _https://clientcenter.api.bingads.microsoft.com/Api/CustomerManagement/v13/CustomerManagementService.svc
   _Using a sandbox endpoint with a production token (or vice versa) also triggers Error 105.

What to Test Next:

1. Decode your OAuth token Verify aud = https://ads.microsoft.com.
2. Confirm the user is in Microsoft Advertising Log in at: https://ads.microsoft.com → Tools → Account access Ensure the user has access to the CustomerId you are calling.
3. Verify the developer token belongs to the same hierarchy If your developer token is tied to a manager account, the CustomerId must be under that manager.
4. Try calling GetUser This is the simplest test call. If GetUser fails with 105, the issue is identity-related, not account-related.
5. Check SOAP headers carefully Even a missing AccountId can cause 105

Sandbox API Authentication Error — Code 105 (InvalidCredentials) - Microsoft Q&A

I hope above information was helpful for you! Our support teams are pleased to engage in more in-depth discussions about your account through phone, chat, or email to offer review assistance, please see our support page to reach out!

I trust that the details shared here will partially address your inquiry. Should you have any further questions, feel free to contact our support. Additionally, I’ve sent you a private message requesting additional information. Please don’t hesitate to reply if you require further assistance.

Kind regards, 

Dagmara | Microsoft Advertising Support Specialist | 800-518-5689