This page covers the MCP server, which lets AI clients call Google Ads tools. To sync Google Ads users, accounts, and roles into C1 for access reviews, see the Google Ads connector instead.
How C1 connects to Google Ads
C1 hosts the Google Ads MCP server, so your users’ AI clients only ever see MCP tools. They never call Google Ads directly. When an AI client calls one of these tools, C1 makes the matching request to the Google Ads API with the calling user’s OAuth token, then returns the result to the AI client. Each request depends on two things you set up in this guide:Google retired Google Ads API developer tokens on September 9, 2026. API access now belongs to the Google Cloud project that owns your OAuth client, so you don’t need a developer token or the Google Ads API Center to set up this server. See Google’s developer token sunset notice.
Before you begin
Gather the following access before you start. Different people can handle the Google Cloud and Google Ads steps.- AI access management must be enabled for your tenant. See Enable AI access management.
- Access to the Google Cloud console with permission to create or select a project, enable APIs, and manage its Google Ads API access level. The Owner, Editor, Quota Administrator, and Service Usage Admin roles include the access-level permissions.
- Admin access to the Google Ads account you want to connect, or to the manager account above it, so you can add users.
- Every user who will authorize must have 2-Step Verification turned on for their Google account. Google requires it each time it issues a new Google Ads API token, including when a user connects or reconnects. Google is also rolling out a passkey requirement. An account that must use a passkey can’t authorize with a text message or authenticator-app code, and a new passkey can take up to 7 days to become trusted, so have users create one early. See Google’s Security requirements for user authentication.
If you don’t see Google Ads in your MCP server catalog, contact the C1 support team to enable it for your tenant.
Set up Google Cloud
Google Ads uses the same Google Cloud project and OAuth client as C1’s other Google MCP servers, but it doesn’t use a quota project. If you’ve already followed Set up a Google Cloud project for MCP servers, reuse that project and OAuth client. Then enable the Google Ads API, request production access, and add the Google Ads scope to the consent screen, as described below.Create or select a Google Cloud project
Pick the project that owns your OAuth client. Google ties Google Ads API access to this project, so use the same project for the API and the OAuth client.1
Sign in to the Google Cloud console.
2
Create a project for C1, or select the project you already use for C1’s Google MCP servers.
Enable the Google Ads API
Enable the Google Ads API in the project that owns your OAuth client.1
Go to APIs & Services > Library and search for Google Ads API. You can also open the enable flow directly.
2
Select Enable.
Request production access for the project
A project with Test access can call only Google Ads test accounts. To use the server with accounts that serve real ads, request a higher access level on the Google Ads API Overview page. Google offers only the next level up, so a project moves from Test to Explorer, then to Basic, then to Standard.
Explorer access covers every tool this server exposes. It blocks only features this server doesn’t use, such as creating client accounts, managing user access, keyword planning, audience insights, reach planning, and billing. Continue to Basic, and then Standard, if your users will run more operations per day than Explorer allows.
Basic and Standard applications require brand verification for the project. Brand verification requires an OAuth consent screen with the External audience and the In production publishing status, so an Internal or Testing app can’t move past Explorer.
1
Open the Google Ads API Overview page for your project and confirm the current access level.
2
Expand Upgrade access level.
3
Confirm the Next access level shown is the one you want.
4
Select Apply for access. For Standard access, the button is Start application, followed by Google’s review questions.
Don’t apply for a developer token or API access from the API Center in a Google Ads manager account. Google no longer processes applications made there.
Configure the OAuth consent screen
The consent screen controls who can authorize the app and which scope they grant.1
Go to APIs & Services > OAuth consent screen (labeled Google Auth Platform on newer projects).
2
Choose the audience:
- Internal limits authorization to accounts in your Google Workspace organization and skips Google’s app verification. Use it when every user signs in with a Workspace account and Explorer’s daily limit is enough.
- External allows any Google account. Use it if users sign in to Google Ads with accounts outside your Workspace, or if you plan to apply for Basic or Standard access.
3
On the Data Access page, add the scope
https://www.googleapis.com/auth/adwords.An External app in Testing publishing status has two limits. Only users you add as test users on the consent screen can authorize, and everyone else sees a “Google hasn’t verified this app” screen. Google also expires each test user’s authorization after 7 days, so they must reconnect their Google account every week. To remove both limits, publish the app and complete Google’s OAuth app verification, which the
adwords scope requires because Google classifies it as sensitive. Internal apps have neither limit, but they can’t complete the brand verification that Basic and Standard access require.Create the OAuth client
Create a web application OAuth client so C1 can send each user through Google’s sign-in.1
Go to APIs & Services > Credentials > Create Client > Web application. For details, see Google’s Manage OAuth Clients documentation.
2
Under Authorized redirect URIs, add exactly the URI that matches your C1 tenant’s domain:
- Default instance:
https://accounts.conductor.one/auth/callback - EU data residency instance:
https://accounts.c1eu.ai/auth/callback
redirect_uri_mismatch error.3
Select Create.
4
Copy the Client ID and Client secret. Google shows the client secret only once.
Unlike some other Google MCP servers, Google Ads doesn’t ask for a Google Cloud Quota Project ID. Google Ads API access and limits follow the project that owns the OAuth client, so your users don’t need the Service Usage Consumer role for this server.
Set up Google Ads
Next, collect the Google Ads account IDs C1 needs and confirm that every user who will authorize can reach the account.Find your Google Ads customer ID
The customer ID identifies the Google Ads account the server works with.1
Sign in to Google Ads and open the account you want to connect.
2
Copy the 10-digit customer ID shown in the top-right corner, under the account name.
3
Remove the hyphens. For example, enter
123-456-7890 as 1234567890.Decide whether users connect through a manager account
A Google Ads manager account (also called an MCC) manages other Google Ads accounts. How your users reach the target account determines whether you need a Login Customer ID:- Users have direct access to the account. Leave Login Customer ID (MCC) blank.
- Users have access through a manager account that the target account is linked under. Set Login Customer ID (MCC) to the manager account’s 10-digit customer ID, without hyphens.
USER_PERMISSION_DENIED.
You don’t need a manager account to use the Google Ads API. Use one only if you already manage several accounts through it.
Give each user access to the Google Ads account
Each user’s tool calls run with that user’s own Google Ads permissions. Add anyone who doesn’t already have access to the account, or to the manager account above it.1
In Google Ads, go to Admin > Access and security.
2
Select the + (plus) button.
3
Enter the user’s email address.
4
Choose an access level:
- Read only for users who only need reporting and list tools.
- Standard or Admin for users who need to create, update, or remove campaigns, ad groups, ads, keywords, or budgets.
5
Select Send invitation. The user must accept the invitation before they can authorize C1.
Optional: Use a Google Ads test account
If your project still has Test access, the server can reach only Google Ads test accounts. Test accounts don’t serve ads, so you can use one to validate your setup while Google reviews your access application.1
Open Google’s create a test manager account page and sign in with a Google account that isn’t linked to a production Google Ads manager account.
2
From the test manager account, select Accounts > + > Create new account to create a test client account.
3
Use the test client account’s customer ID as the Google Ads Customer ID when you register the server, and the test manager account’s ID as the Login Customer ID (MCC).
Register the Google Ads MCP server in C1
With your Google Cloud project and Google Ads account ready, register the server and enter its credentials.1
Follow Register an MCP server and select Google Ads from the catalog.
2
When you configure authentication, choose per-user OAuth and enter your OAuth client’s Client ID and Client secret, plus the scope
https://www.googleapis.com/auth/adwords.3
Fill in the Google Ads settings:
4
Save your changes. The first time a user calls a Google Ads tool from their AI client, C1 prompts them to connect their Google account.
Tools the Google Ads MCP server provides
The server exposes read tools for reporting and write tools for changing the account. Each user’s Google Ads access level still limits what their calls can do.
Review the write tools, and the budget tool in particular, before you approve them.
How Google Ads credentials are shared
Each user authorizes with their own Google account, so tool calls run under that user’s Google Ads identity and access level. The OAuth client ID, client secret, customer ID, and Login Customer ID are shared settings on the server. They apply to every user. C1 also records each call in the AI tool usage audit log. For how shared and per-user credentials work across MCP servers, see Configure authentication.Discover and govern tools
After you register the server, C1 runs tool discovery against Google Ads. Discovered tools appear on the server’s Tools tab. Each tool starts as either Pending review or automatically Approved, depending on the option chosen when the server was set up or your tenant’s default tool settings in AI > MCPs > Settings. See Require tool approval and Default tool classification. Before anyone can call a Google Ads tool, it must be approved, added to a toolset, and bound to an access profile. Continue to Govern tools and toolsets to set this up.Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn’t confirm that authentication is working. You confirm your Google Ads setup when an approved user successfully calls a Google Ads tool from their AI client.
Manage your Google Ads credentials
- Rotate the OAuth client secret in your Google Cloud project under APIs & Services > Credentials, then update the secret on the server’s authentication settings in C1.
- Change a user’s Google Ads access in Google Ads under Admin > Access and security. The change applies to that user’s next tool call.
- An individual user can revoke access at any time from their Google Account’s linked apps page. See Google’s Manage third-party apps & services with access to your account documentation.