# Set up Google Ads

Get a Google Ads developer token, create an OAuth client and sign in from your terminal.

Google Ads needs 2 things LinkedIn does not.

## A developer token

Get it from a Google Ads manager (MCC) account at [ads.google.com/aw/apicenter](https://ads.google.com/aw/apicenter). A plain client account cannot issue one. Approval usually lands on Explorer access automatically (2,880 production operations per day).

Explorer access is not enough for `adwarp google keywords`. Explorer blocks KeywordPlanService, so keyword research needs Basic access (15,000 operations per day), which is a separate application on the same screen. Campaign creation and reporting work fine on Explorer.

## An OAuth client

Create it in a Google Cloud project with the Google Ads API enabled. Use the "Desktop app" type, which accepts any `localhost` redirect.

Do not leave the consent screen in "Testing". That status issues refresh tokens that stop working after 7 days. Beyond that it is a trade-off:

- Internal (Google Workspace organizations only) is what Google's OAuth docs recommend for a single-company tool. It is the simplest, with no verification and no 7-day expiry.
- External and In production is the precondition for brand verification, the pilot that cuts Basic access review from days to hours. The cost is that `auth/adwords` is a sensitive scope, so a published external app can require full OAuth app verification, which may take longer than the wait it saves.

Internal is the better default for an internal tool. Choose External only if the fast track is worth the verification risk.

## Configure and log in

Write `~/.adwarp/google.json`:

```json
{
  "clientId": "....apps.googleusercontent.com",
  "clientSecret": "...",
  "developerToken": "...",
  "loginCustomerId": "1234567890",
  "defaultCustomerId": "0987654321",
  "defaultConversionActionNames": ["Demo Booked"]
}
```

`loginCustomerId` is the manager account, and is only needed when you reach the target account through one. Run `adwarp google auth login` and you are set.

## Environment variables

For CI or a server, set these instead of writing `google.json`. When `ADWARP_GOOGLE_CLIENT_ID` and `ADWARP_GOOGLE_CLIENT_SECRET` are both set, Adwarp reads its Google settings from the environment only and ignores `google.json`.

| Variable | Replaces |
| --- | --- |
| `ADWARP_GOOGLE_CLIENT_ID`, `ADWARP_GOOGLE_CLIENT_SECRET` | `clientId`, `clientSecret` |
| `ADWARP_GOOGLE_DEVELOPER_TOKEN` | `developerToken` |
| `ADWARP_GOOGLE_LOGIN_CUSTOMER_ID` | `loginCustomerId` |
| `ADWARP_GOOGLE_DEFAULT_CUSTOMER_ID` | `defaultCustomerId` |
| `ADWARP_GOOGLE_API_VERSION` | `apiVersion`, the pinned Google Ads API version (default `v25`) |
| `ADWARP_GOOGLE_REFRESH_TOKEN` | the login in `~/.adwarp/google-credentials.json` |

`ADWARP_GOOGLE_REFRESH_TOKEN` works on its own too, next to a `google.json`. Setting it also turns off change journaling for Google writes. `defaultConversionActionNames` has no variable, so with environment settings a brief names its own conversion actions. The `GADS_*` names from before the rename still work; see [Configuration](https://adwarp.dev/docs/config#names-from-before-the-rename).

See the [CLI reference](https://adwarp.dev/docs/cli#google-ads-commands) for every Google command and [MCP tools](https://adwarp.dev/docs/tools/google-ads) for the `gads_*` tools.

Canonical page: https://adwarp.dev/docs/google-ads-setup
Last updated: 2026-10-18