When you create API certificate to link your Apple Search Ads Account with SearchAdsHQ, you select the Campaign Group and assign Group Manager role to it. This step may be confusing because you see the word Account at this step.
When you select Limited Access and click on the selector you see all the Campaign Groups you have in this account.
Note, that you can include a few campaign groups into one certificate.
Note, that Read Only certificates are not supported.