Google Ads access inventory checklist (programmatic proxy test)

What's inside

• The inventory columns: tool, reads or writes, where it runs, whose Cloud project, whose developer token, how end users sign in
• The four-way label: own use (yours), self-run open source on your credentials, vendor tool you sign in to, hosted endpoint that re-exposes Google Ads calls
• The policy test for the last label: does the service 'solely replicate, wrap, or re-expose' Google Ads programmatic capabilities to a business other than the token holder?
• The write test: can anything change an account headlessly, without a per-entity Google sign-in?
• The housekeeping: API Center contact email current, refresh tokens encrypted at rest, no Google Ads API v22 calls left before its 7 October 2026 sunset

Install

1. Export the OAuth apps with access from each Google account that manages Google Ads, and list every connector, script, agent and MCP client your team uses.
2. For each, ask the vendor in writing which Google Cloud project and developer token its calls run on, and whether your agents call Google Ads through their endpoint.
3. Label every row; for any hosted endpoint on someone else's token, apply for your own developer token and run the tool, or Google's open-source google-ads-mcp, on your own credentials.
4. In your own Cloud project, open APIs & Services, Google Ads API, Metrics, and check the Methods table for any v22 method names.

Breaks on

The logged changes that can invalidate this artifact. A new one triggers a re-check.

• 31 Aug 2026 · Google Ads Developer Policies prohibit programmatic proxies, hosted MCP servers included