Cloud-managed access levels

This feature lets your API access levels be managed by a Google Cloud organization, giving you the following benefits:

• No more need to secure developer tokens: API access is managed through the Google Cloud organization so you no longer need to worry about securing developer tokens or leaking it. You can skip sending your developer token in your API calls, though you still need to send an access token.

• Maintain separate Google API Console projects for different apps: Any project linked under the Google Cloud organization inherits the API access level of the organization. This lets you create multiple Google API Console projects under this organization for purposes such as granular project management, separate projects for different apps, and multiple Google API Console projects for your team members.

• Finer quota monitoring and management: You can monitor the API usage of individual projects or cap API usage.

Prerequisites

• An approved developer token

  You should already have an approved developer token to use this option. You can find an existing developer token on the API Center page of your Google Ads manager account. Sign in, then navigate to TOOLS & SETTINGS > SETUP > API Center.

• A Google Cloud organization

  The Google Ads API associates your developer token to a Google Cloud organization and uses it to determine your API Access levels. There are multiple ways to create a Google Cloud organization.

  Scenario	Steps
  You're an existing Google Workspace or Google Cloud Identity customer	Chances are that you already own an organization resource. You can Check and create one if required.
  You don't use Google Workspace or Google Cloud Identity	Sign up for the free edition of Google Cloud Identity. Then create your organization resource.
  None of the preceding options work for you	Explain your scenario when you sign up for the pilot and request Google to create an organization resource for you. Google will own and manage this organization resource at no charge.

• Prepare your Google API Console projects for the pilot program

  You need to prepare the Google API Console projects you use with the Google Ads API for the pilot program as follows:

  Scenario	Steps
  You already own a Google Cloud organization or created one in the previous step	Ensure that all the Google API Console projects where you've enabled the Google Ads API is under this organization. If it isn't, migrate it under the organization. If you're an existing Google Workspace or Google Cloud Identity customer, chances are that the Google API Console projects are already under your organization so you can skip this step.
  You don't own a Google Cloud organization and couldn't create one in the previous step	Ensure that you're both an administrator user on your Google Ads API manager account and your Google API Console project. You need this permission to perform additional steps after your pilot application is approved.

• An up-to-date API contact email

  Ensure that your Google Ads API contact email is up-to-date. Your API contact details are listed on the API Center page of your Google Ads API manager account. Sign in, then navigate to TOOLS & SETTINGS > SETUP > API Center.

Sign up for the pilot program

Sign up for the pilot program. The Google Compliance team will then review your application and email your API contact email address with the approval status and additional details.

If you requested Google to create a Google Cloud organization for you, there are a few additional steps involved:

1. Google will create a Google-owned Cloud organization resource for you. All the administrators of your Google Ads API manager account will be granted the roles/resourcemanager.projectCreator role on the newly created organization.

2. Google will email your API contact email address with the details of the newly created organization resource.

3. You need to sign in to your Google API Console account and follow the instructions to move your Google API Console project under the new organization.

4. Reply to the email to let Google know that your projects are moved under the new organization.

5. The Google Compliance team will review your application and email your API contact email address with the approval status and additional details.

Modify your API requests

You can modify your app to stop sending the developer-token header when making API calls. This is an optional but recommended step. If you're in the pilot program, the Google Ads API server ignores the developer-token if sent as part of the API requests.

// Create a client.
GoogleAdsClient client = new GoogleAdsClient();

// Opt into the pilot.
client.Config.UseCloudOrgForApiAccess = true;

// Make the API calls.
...

curl -i -X POST https://googleads.googleapis.com/v16/customers/CUSTOMER_ID/googleAds:searchStream \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "login-customer-id: LOGIN_CUSTOMER_ID" \
  --data-binary "@query.json"

Frequently asked questions

Does this change mean that I need to be a Google Workspace or Google Cloud customer to use the Google Ads API?

No. You need a Google Cloud organization which can be obtained in many ways. This requirement is similar to how you need a Google API Console project to use the Google Ads API today.

I need to change my API Access levels. How can I do this?

You should continue to use the API Center for now to request any changes to the API access levels.

Is there any downtime for opting in to this pilot?

No, there isn't. The Google Ads API will automatically start using the organization-level API access levels once it is approved.

How much effort does it take to participate in this pilot?

Expect minimal code changes. Most developers should be able to complete changes to their app in under 30 minutes.

Will I be charged if I opt in to this pilot?

In general, no, you won't be charged if you opt in to this pilot. The Google Ads API is offered at no charge, and Google isn't making any changes to the Google Ads API pricing model.

The possible scenarios for obtaining a Google Cloud organization are as follows:

1. You're an existing Google Workspace or Google Cloud Identity customer:

   You'll be charged as usual for any regular usage of those products. You won't be charged for creating a Google Cloud organization for the purpose of participating in this pilot.

2. You created a Google Cloud Identity free edition account:

   You won't be charged when signing up for Google Cloud Identity free edition account or for creating a Google Cloud organization for the purpose of participating in this pilot.

3. Google created a Cloud organization resource for you:

   This is a Google-managed internal Cloud organization resource so you won't be charged as a result.

I have multiple developer tokens for different tools. How does this pilot affect me?

This use case isn't supported so you won't be able to participate in this pilot.

Does this affect any existing API authorization to the accounts I manage using the Google Ads API?

No, this change doesn't affect any existing API authorizations to the Google Ads accounts you manage using the Google Ads API.

I opted in to this pilot and have an issue or feedback. How do I contact support?

Contact the Google Ads API team using the API technical support page and explain the nature of your issue. Include details such as your organization ID and request and response logs when possible.