Connect Google Ads

You connect Google Ads by pasting credentials you own: an OAuth client, a developer token and a refresh token issued to that client. There is no Google sign-in screen. The credentials cover conversions and audiences for the customer you enter, and they are used only for your connection.

Each environment holds one Google Ads connection. Once it exists, the Google Ads card shows the connection instead of a connect button. To use a different customer, remove the connection first.

Before you start

• You need Create and manage on Ad platforms.
• You need a Google Ads customer and a Google user that can open it.
• You need a Google Cloud project with the Google Ads API turned on, and an OAuth client in it.
• You need a Google Ads developer token. It comes from a manager account.
• For conversions, create the conversion actions in Google Ads first. TrueEngage lists the enabled conversion actions that accept click uploads.
• For audiences, the customer must be eligible for Customer Match. Google decides eligibility, based on spend and account history.

Find the values

Value	Where to find it
Customer ID	In Google Ads, the 10-digit number at the top right, next to the account name. Use the account that runs the ads. Dashes are fine
Manager account ID (optional)	Only if you reach the customer through a manager account. Open the manager account in Google Ads and copy the 10-digit number at the top right. Leave it empty otherwise
Client ID	In Google Cloud Console, open APIs and Services, then Credentials. Create an OAuth client ID, or open an existing one. The client ID is listed with it
Client secret	On the same OAuth client page. If it was not saved, add a new secret to the client
Developer token	In Google Ads, sign in to a manager account and open Tools, then API Center
Refresh token	Authorise your OAuth client once, as a Google user who can open the customer, with the Google Ads scope (https://www.googleapis.com/auth/adwords) and offline access. Exchange the code Google returns for tokens and keep the refresh token. It must be issued to the client ID you paste

TrueEngage uses the refresh token to get fresh access tokens itself. You never paste an access token.

Developer token access levels

Google gives every developer token an access level:

• Test account access works only with test accounts. A real customer is refused.
• Explorer, Basic and Standard access work with real customers, within the daily limits Google sets for each level.

If your token has test access, apply for a higher level in the API Center before you connect a real customer. Google reviews the application, and it can take some days. The levels and limits are set by Google and can change, so check the API Center for what your token has.

Connect an account

1. Open Data, then Ad platforms.
2. On the Google Ads card, select Connect with credentials.
3. Enter a Name, the Customer ID and, if you use one, the Manager account ID. Select Continue.
4. Enter the Client ID, Client secret, Developer token and Refresh token. The secret and token fields hide what you paste.
5. Select Connect and check.
6. Read the checks, then select Open connection.

TrueEngage verifies the credentials while it saves them. It refreshes the token with your client, then reads your customer with your developer token. If Google refuses them, the dialog stays on the credentials step and says why, and nothing is saved. Fix the value and select Connect and check again.

TrueEngage stores the client secret, developer token and refresh token encrypted and never shows them again.

What TrueEngage sends

• Conversions with a click id. If the person has a gclid, gbraid or wbraid that is still valid, TrueEngage uploads a click conversion with it. Click ids are valid for 90 days from the click.
• Conversions without a click id. TrueEngage sends the conversion with the person's hashed email and phone as enhanced conversion identifiers.
• Order ID. The event ID is sent as the order ID, so a repeated upload does not count twice.
• Consent. Both Google consent signals, ad_user_data and ad_personalization, are sent as granted. TrueEngage sends only people who passed your consent rule. See Ad consent.
• Time zone and currency. The conversion time uses the Google Ads account's time zone. The currency comes from the event, or your account currency.

Choose a destination

When you map an event, the Destination event list shows your account's conversion actions. Pick one. Free text is refused, because Google Ads only accepts an action that exists. See Send events as conversions.

Test safely

Save and send test on a Google Ads mapping always runs in validate-only mode. Google checks the request and records nothing. The delivery shows as Skipped with the reason Checked in test mode only.

Audiences

Audiences use Google's Data Manager API. A new list can take 6 to 48 hours to fill, and Google needs at least 1,000 matched people before it serves ads to the list. See Sync segments to ad audiences.

Replace credentials

When Google stops accepting the credentials, the connection shows Reconnect needed. Open it, select Enter new credentials, and paste only the values that changed. Leave a field empty to keep what is stored. TrueEngage checks the new values before it resumes sending. A new refresh token must be issued to the client ID that is stored or pasted. See Fix connection errors and reconnect.

Connections made earlier with Google sign-in

Connections created before credentials were required keep working. The connection page shows Signed in with Google, and Reconnect with Google Ads signs in again with a user that can reach the same account. These connections use the platform's shared Google app, not your credentials. New connections always use your own credentials.

Common problems

• invalid_client. Google does not recognise the client ID or client secret. Copy them again from the same OAuth client in Google Cloud Console, and check the secret was not replaced or deleted.
• invalid_grant. The refresh token has expired or been revoked, or it was issued to a different client. This also happens when the Google user removed access. Authorise your client again and paste the new refresh token. Refresh tokens from a Google Cloud app left in testing mode expire after 7 days, so publish the app to keep them.
• The developer token is not approved, or is test-only. Google refuses real customers with a token that only has test access. Apply for a higher access level in the API Center. The check shows GOOGLE_DEV_TOKEN_TEST_ONLY.
• The developer token is not accepted. Check it was copied in full, and that it belongs to a manager account.
• No access to the customer. The Google user who authorised the refresh token cannot open this customer. Check the customer ID, and add the manager account ID if you reach the customer through a manager. Give the user access in Google Ads, or authorise as a user who has it.
• Google is busy. Wait a few minutes and check again. Google rate limits requests.

For the codes, see Ad platform error codes.

What happens next

• Send events as conversions
• Tracking attributes and click ids
• Fix connection errors and reconnect