Shared aliases

When working with the Google Ads API, there are multiple places where email addresses are used for contact and access management, the most important of which are the following:

• Google Ads API contact email: This is the email listed as the contact in the API Center of the Google Ads UI.
• Google Cloud Console account email: This is the email that has administrator access to the Google Cloud Console account used for your OAuth 2.0 application.
• Google Ads manager account email(s): These are the emails that have administrator permissions on the manager Google Ads account(s) you access through the Google Ads API. When you generate a refresh token for your application, you usually authenticate your Google Ads API application with one of these emails.

We strongly recommend using shared team aliases so that you don't lose access to these accounts when individual team members switch teams or leave the company. The rest of this guide elaborates on each of the emails listed earlier and how you can update it to use a shared team alias instead of an individual user's email address.

Google Ads API contact email

The Google Ads API contact email is an email address you provide when signing up for the Google Ads API. You should ensure access to this alias and monitor emails sent to this address regularly. Google uses this email address to contact your team during API reviews, audit requests, or production emergencies that require immediate attention. Use a shared team alias as the contact email to ensure that the whole team receives these notifications.

Follow these steps to update the API contact email:

• Sign in to the Google Ads manager account that you used when applying for Google Ads API access. This is the same account where your developer token is located.
• Navigate to Tools & Settings > API Center.
• Click the arrow under the API contact email section.
• Update the email address and click the Save button.

Google Cloud Console account

The Google API Console project contains your application's OAuth credentials and controls access to the Google Ads API. Ensure access to this account by making a shared alias the account owner.

Follow these steps to update the Google API Console project's owner:

• Sign in to Google API Console.
• Select your project from the drop-down menu on the top-left corner of the page.
• Navigate to IAM and admin > IAM from the left menu.
• Click the Grant Access button.
• Enter the shared email address under the Add principals section.
• Assign the Owner role.
• Click the Save button. Refer to the Cloud documentation to learn more about granting and revoking access.

Google Ads manager account

A common method of managing accounts using the Google Ads API is to link all your accounts under a common manager account, and make API calls to all the accounts using the top-most manager account's credentials. In this configuration:

• The developer issues a refresh token using the credentials of a user who has access to the Google Ads manager account.
• The developer sets the login_customer_id header as the customer ID of the Google Ads manager account, and the customer_id header as the customer ID of the account to which API calls are made.

One potential risk of this setup is that if the authorized user loses access to the Google Ads manager account, the refresh token is no longer valid and all API calls fail. To avoid this scenario, you can invite a shared email alias to manage this Google Ads manager account with the appropriate access levels. Use this shared email alias to issue the refresh token for making API calls.