Google Ads API Access: The Complete 2026 Guide

To call the Google Ads API you need four things: a Google Cloud project with the Google Ads API turned on, an OAuth consent screen with test users, an OAuth client (client ID and client secret), and a refresh token from an account that can see your ad accounts. Your access level used to come from a developer token in your MCC. That changed on September 9, 2026. Now the access level belongs to the Cloud project, and you apply for it in the Cloud Console.

I recorded three videos on this: one on the Google Cloud project, one on the full OAuth setup, and one on applying for Basic access with a developer token. The Cloud and OAuth steps in the first two still apply as shown. The third video shows the old MCC flow, which Google has since retired. This post brings all three together and updates them for how things work today.

What you need before you start

• A Google account you will keep. The Cloud project, the OAuth app and the access level all hang off it. Don't use a throwaway.
• A live company website on a domain you control. Google checks it for brand verification and Basic access.
• A Google Ads account with real campaigns, or a manager account that is linked to client accounts. A manager account is optional for getting access. You'll want one if you report on many clients.
• A Google Cloud billing setup that is not on the Free Trial. More on why in the errors section.
• Python 3.9+ if you want to run the code below.

How Google Ads API access works now

Before September 2026, every app sent a 22-character developer token. That token carried the access level: Test, Basic or Standard. You applied for it in the API Center of a manager account, with a form and a design document. That's what my developer-token video shows.

Google retired that model. From the official policy page, after the sunset:

• Access levels belong to Google Cloud projects. The project that owns your OAuth client ID decides what you can do. With a service account, it's the project that owns the service account.
• Existing token access levels were moved to Cloud projects, based on API activity in the 90 days before the sunset.
• The developer-token header is optional and ignored. Google says it will start rejecting it in a future major version.
• You sign up and manage access on the Google Ads API Overview page in the Cloud Console, not in the API Center.

There are four access levels:

Explorer is new. In my developer-token video I said I never got it automatically and always started on Test. Now you ask for it from the console and Google usually approves it with an automated check. For a small agency reporting on a handful of accounts, 2,880 operations a day is often enough to start building.

Step 1: Create the Google Cloud project

1. Go to console.cloud.google.com.
2. Click the project dropdown at the top, then New project.
3. Give it a clear name, like "Google Ads dashboard". It takes a few seconds to provision.
4. Make sure the new project is selected in the dropdown before you go on. Half the confusion I see comes from enabling things in the wrong project.

Keep one project per product. Your access level lives on this project now, so moving to another project later means applying again.

Step 2: Enable the Google Ads API

1. Go to APIs & Services → Enable APIs and services.
2. Search for "Google Ads API".
3. Open it and click Enable.

That alone gives the project Test access. You can now call test accounts, but not real ones.

Step 3: Configure the OAuth consent screen

This is what your users see when they connect their Google Ads account.

1. Go to APIs & Services → OAuth consent screen and click Get started.
2. App name: something your clients will recognise, like your agency or product name.
3. User support email: pick your email.
4. Audience: choose External. Internal only works inside your own Google Workspace and won't let client accounts connect.
5. Contact email: a real address. Google sends verification and policy mail here.
6. Agree to the policy and create.

Step 4: Add test users (the step people skip)

While the app is in Testing, only emails on the test-user list can finish the OAuth flow. Everyone else gets an access_denied error.

1. Go to Audience.
2. Under Test users, add every Google account that will connect during development. That's yours, your teammates' and any client logins you're testing with.

If OAuth "just doesn't work" for one person but works for you, check this list first.

Step 5: Add the Google Ads scope

The Google Ads API uses one OAuth scope:

https://www.googleapis.com/auth/adwords

In Data access, click Add or remove scopes, find the Google Ads API scope and add it. Google classes it as a sensitive scope. That doesn't matter while you're in Testing. It matters when you publish the app, because publishing with a sensitive scope triggers Google's OAuth app verification. I cover that in the app review field guide.

Step 6: Create the OAuth client

1. Go to Clients → Create client.
2. Application type: Web application.
3. Authorized redirect URIs: add the callback URL of your app. For local development, add http://localhost:8080/. You can add your production URL later.
4. Create, then copy the Client ID and Client secret, or download the JSON.

Treat the client secret like a password. It goes in an environment variable or a secrets manager, never in your frontend or a public repo.

Step 7: Apply for Explorer or Basic access

This replaces the old developer-token application.

1. In the Cloud Console, open the Google Ads API Overview page for your project.
2. Check the current access level. A new project shows Test.
3. Expand Upgrade access level. Confirm the next level is Explorer and click Apply for access. Google approves most Explorer requests with an automated review.
4. For Basic, complete brand verification for the Cloud project first. Then come back, confirm the next level is Basic, check there are no brand verification warnings, and apply.
5. For Standard, start the application from the same page. Expect a manual audit, and make sure your tool meets Google's Required Minimum Functionality.

You need quota management permission on the project to do this. Owner, Editor, Quota Administrator and Service Usage Admin include it by default.

What carried over from my Basic-access video

The form in that video is gone, but the advice behind it still holds. Google wants to see a real business with a real use case:

• Use a live website on your own domain, with the company name on it. No placeholder sites.
• Use a contact email on that domain if you can.
• Be specific about what the tool does: "reporting dashboard for our agency's client accounts" beats "Google Ads integration".
• Only build what you describe. Standard access audits check the tool against what you said it does.

If you applied for Basic with a developer token before September 9, 2026 and were still pending, Google closed that application. You need to apply again from the Overview page.

Step 8: Get a refresh token

Your app now needs a refresh token from a user who can see the ad accounts. Here is a small script using google-auth-oauthlib. It opens a browser, you log in with a test user, and it prints the refresh token.

pip install google-auth-oauthlib google-ads

# get_refresh_token.py
from google_auth_oauthlib.flow import InstalledAppFlow

SCOPES = ["https://www.googleapis.com/auth/adwords"]

flow = InstalledAppFlow.from_client_secrets_file(
    "client_secret.json",  # the JSON you downloaded in Step 6
    scopes=SCOPES,
)

# Uses http://localhost:8080/ as the redirect URI.
# That exact URI must be in "Authorized redirect URIs" on your web client.
creds = flow.run_local_server(
    port=8080,
    access_type="offline",  # ask for a refresh token
    prompt="consent",       # force Google to issue one even if you consented before
)

print("Refresh token:", creds.refresh_token)

Store the refresh token server-side, encrypted. In a multi-client dashboard you store one per connected Google account.

Step 9: Make your first call

With the official Python library:

# first_call.py
import os
from google.ads.googleads.client import GoogleAdsClient

config = {
    "client_id": os.environ["GOOGLE_ADS_CLIENT_ID"],
    "client_secret": os.environ["GOOGLE_ADS_CLIENT_SECRET"],
    "refresh_token": os.environ["GOOGLE_ADS_REFRESH_TOKEN"],
    # The manager (MCC) account ID, digits only, if you access clients through it.
    "login_customer_id": os.environ.get("GOOGLE_ADS_LOGIN_CUSTOMER_ID"),
    "use_proto_plus": True,
}
# Older library versions still demand a "developer_token" key.
# Upgrade google-ads. Until then, your old token is accepted and ignored.

client = GoogleAdsClient.load_from_dict({k: v for k, v in config.items() if v})
ga_service = client.get_service("GoogleAdsService")

query = """
    SELECT campaign.id, campaign.name,
           metrics.impressions, metrics.clicks,
           metrics.cost_micros, metrics.conversions
    FROM campaign
    WHERE segments.date DURING LAST_7_DAYS
    ORDER BY metrics.cost_micros DESC
"""

customer_id = "1234567890"  # the client account, digits only, no dashes
for batch in ga_service.search_stream(customer_id=customer_id, query=query):
    for row in batch.results:
        cost = row.metrics.cost_micros / 1_000_000
        print(f"{row.campaign.name}: {row.metrics.clicks} clicks, {cost:.2f} spend")

The same thing over REST, if you want to test with curl. First swap the refresh token for an access token:

ACCESS_TOKEN=$(curl -s https://oauth2.googleapis.com/token \
  -d client_id="$GOOGLE_ADS_CLIENT_ID" \
  -d client_secret="$GOOGLE_ADS_CLIENT_SECRET" \
  -d refresh_token="$GOOGLE_ADS_REFRESH_TOKEN" \
  -d grant_type=refresh_token | jq -r .access_token)

curl -s -X POST \
  "https://googleads.googleapis.com/v26/customers/1234567890/googleAds:search" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "login-customer-id: 9876543210" \
  -H "Content-Type: application/json" \
  -d '{"query": "SELECT campaign.name, metrics.clicks FROM campaign WHERE segments.date DURING LAST_7_DAYS"}'

v26 is the current version as I write this (released October 14, 2026). Google ships new versions several times a year and sunsets old ones, so check the release notes and pin a version on purpose.

To list which accounts a refresh token can see, call CustomerService.list_accessible_customers. It's the first thing my dashboards do after a client connects.

Common errors and how to fix them

access_denied during OAuth. The Google account isn't on the test-user list. Add it under Audience, or publish the app.

redirect_uri_mismatch. The redirect URI your code sends must match one on the OAuth client character for character, including the trailing slash and the port.

invalid_grant on refresh. The refresh token is dead. The usual cause: an External app in Testing status, where Google expires refresh tokens after 7 days. Other causes are the user revoking access, changing their password, or you issuing too many tokens for the same client and user. Publish the app and reconnect.

CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION (v25+), or ACTION_NOT_PERMITTED (v24 and older). The project only has Test access and you called a real account. Apply for Explorer on the Overview page.

DEVELOPER_TOKEN_NOT_APPROVED. You'll see this in older tutorials and old code. Under the new model, check the access level of the Cloud project that owns your OAuth client. It's easy to have created credentials in one project and applied for access in another.

USER_PERMISSION_DENIED. You're reaching a client account through a manager account but didn't set login-customer-id, or the logged-in user has no access to that account.

Basic or Explorer rejected even though the brand is verified. Google lists this as a known issue for projects on the Cloud Free Trial or with suspended or disabled billing. Upgrade billing to a paid account, wait a few minutes, then reapply.

AUTHORIZATION_ERROR on production calls after an upgrade. Google lists a known issue for some projects upgraded after September 9, 2026. Their suggested workaround is to apply for Explorer from a new project.

A checklist you can keep

• Cloud project created and selected
• Google Ads API enabled
• OAuth consent screen: External, real contact email
• Test users added
• https://www.googleapis.com/auth/adwords scope added
• Web OAuth client with the correct redirect URIs
• Explorer access, then brand verification and Basic
• Refresh token stored server-side, encrypted
• login_customer_id set when you go through an MCC
• API version pinned and on your calendar to upgrade

How Scalvo can help

Setting up Google Ads API access is the part that stops most agencies before they build anything. If you want the Cloud project, OAuth verification and access level handled for you, that's what our app approval and launch service is for. If you already know which reporting tool you want and just need it built on top of these credentials, look at custom tool replicas, or book a call and tell me what you're trying to report on.