How to Get Your Google Ads API Key

Published May 25, 2026 · Last updated November 9, 2026

Google Ads doesn't have a single API key. API access comes from an OAuth client (client ID and secret) in Google Cloud, plus a refresh token created when a user authorizes your app. And your Google Cloud project starts at a Test access level: everything works against test accounts, but production calls fail until you apply for an upgrade—which is where most teams get stuck.

ℹ️ Developer tokens are retired. Google sunset Google Ads API developer tokens on September 9, 2026. You no longer need one, and API access levels now belong to your Google Cloud project instead.

This guide walks through the credentials in order, explains the access levels that trip people up, and covers the login-customer-id nuance you'll hit the moment you manage client accounts.

Key takeaways

There's no Google Ads "API key." You need an OAuth client ID and secret and a refresh token. A developer token is no longer required.
Everything lives in Google Cloud Console: the OAuth client, and the API access level of the project that owns it.
New Cloud projects start at Test access and cannot touch real, spending accounts. You must apply for Explorer, Basic, or Standard access, which Google reviews.
When a manager account accesses client accounts, you must send login-customer-id (the manager's ID) alongside the target customer_id, or calls fail with permission errors.

Before you start

You'll need a Google account with access to the Google Ads accounts you want to reach. If you manage several client accounts, a Google Ads manager account (MCC) is the recommended way to centralize access.

Step 1: Set up OAuth credentials (Google Cloud Console)

Create a project. In Google Cloud Console, open the project dropdown → New project → name it → create.
Enable the API. Go to APIs & Services → Library, search Google Ads API, and click Enable.
Configure the OAuth consent screen. Under APIs & Services → OAuth consent screen, choose External or Internal, fill in the app name and support emails, and on the scopes step add the Google Ads scope: https://www.googleapis.com/auth/adwords. Publish the app when you're ready to move from Testing to Production.
Create credentials. Go to APIs & Services → Credentials → Create credentials → OAuth client ID. Choose the application type (Web application or Desktop app); for web apps, set your authorized redirect URI. Copy the client ID and client secret.

Step 2: Request production access for your project

Your Cloud project's access level controls which accounts you can reach and how many operations you can run per day:

Test: test accounts only. This is where every new project starts.
Explorer: test and production accounts, with a lower daily limit on production operations.
Basic: test and production accounts, suitable for most products in early production.
Standard: test and production accounts, effectively unlimited daily operations for large or commercial products.

To apply, open the Google Ads API overview page for your project in Google Cloud Console. The API Center in Google Ads manager accounts no longer processes applications.

Things to know before you apply:

Brand verification is required for Basic and Standard access.
Projects on the Google Cloud free trial, or with a suspended billing account, may be rejected even after brand verification. Upgrading the project to a paid billing account resolves this.
Apply early, not after you've built everything. Treat the review as a real timeline item.

Step 3: Get a refresh token

Using your OAuth client ID and secret, run an OAuth flow (Google's client libraries for Python, Node, and others ship example auth scripts) that opens a browser consent and outputs a refresh token. Your backend stores this and exchanges it for short-lived access tokens on each run.

With your OAuth client ID/secret and refresh token in place, you can call the API. Two values matter when a manager account operates on client accounts:

customer_id — the Google Ads account you're reading or modifying (the child account).
login-customer-id — the manager account that has access to it, in 8–10 digit format with no dashes.

If you omit login-customer-id, or set it to the client instead of the manager, calls fail with USER_PERMISSION_DENIED ("User doesn't have permission to access customer")—even when everything looks correctly linked. This is one of the most common post-setup errors.

The gotcha that blocks production (read this before you build)

Here's the failure pattern that shows up constantly: a team creates a Cloud project, wires up OAuth, builds the integration, and everything works against a test account. Then they switch customer_id to a real, spending account—and every request fails with an error saying the Cloud project isn't approved for production.

That's the Test access level. Authorization succeeds, but production reads fail until the project is upgraded to Explorer, Basic, or Standard. If users can connect but no data comes back, check your project's access level first.

Keeping your credentials secure

Client secret and refresh token are server-side only—never in client code or a public repo. Store them in environment variables or a secrets manager.
Use one Google Cloud project for your Google Ads OAuth client. Your access level belongs to that project, so mixing credentials from multiple projects is a common cause of "works in one place, fails in another" confusion.
Store tokens per customer (refresh token, scope, expiry, the authorizing account) mapped to your workspace, and refresh proactively so scheduled jobs don't break.

Frequently asked questions

What's my Google Ads API key? There isn't one. You need OAuth credentials—client ID, client secret, and a refresh token—from Google Cloud Console.

Do I still need a developer token? No. Google retired developer tokens on September 9, 2026. Access is now controlled by your Google Cloud project's access level.

Why does my integration work in test but fail on real accounts? Your Cloud project is at Test access. Apply for Explorer, Basic, or Standard access from the Google Ads API page in Google Cloud Console—and expect a review wait.

What's login-customer-id for? When your manager account accesses a client account, login-customer-id is the manager's ID (no dashes) and customer_id is the child account. Omitting it causes permission errors.

What OAuth scope do I request? https://www.googleapis.com/auth/adwords.

Do I need a manager (MCC) account? It's not required, but it's the recommended way to centralize access when you manage multiple client accounts.

Connecting Google Ads alongside your other ad platforms

OAuth setup, a project access level with a review queue, and the login-customer-id nuance—that's the setup for one ad platform. Repeat it for each: LinkedIn requires a vetted app and 3-legged OAuth; Meta needs an app, access token, and business verification. Every platform has its own object model and reporting semantics on top.

Unified.to collapses that into one integration. Unified provides Google Ads through its normalized Advertising API—working with ad accounts (organizations), campaigns, groups, ads, creatives, targeting, and performance reports as consistent objects—alongside other advertising integrations, including LinkedIn, Meta Ads, TikTok Ads, Amazon Advertising, and Microsoft Advertising, across one connection model. You pull cross-platform performance from a single endpoint (GET /ads/{connection_id}/report) with normalized KPI selectors, and read/write campaign controls without per-platform branching. Unified manages each platform's authorization—including Google's OAuth—so you handle credentials and token refresh in one place, not across a dozen consoles.

It's the same pattern that lets teams like Humi ship integrations in days rather than building each one in-house: integrate once per category, and get every platform in it.

→ Start your 30-day free trial

→ Book a demo

All articles