Google Ads API Access in 2026: Explorer, Basic and the Developer-Token Sunset

Until September 2026 the first step to using the Google Ads API was a developer token from a manager account. That changed: Google's documentation now states that "developer tokens were sunset on September 9, 2026" and that "your API access levels are determined by the Google Cloud project you used to generate your OAuth credentials". If you are setting up a reporting tool, a connector or your own integration for a real ad account, these are the steps as of October 2026.

What you are setting up

• A Google Cloud project with the Google Ads API enabled. The access level belongs to this project.
• An OAuth client in that project, so a user can sign in and grant the https://www.googleapis.com/auth/adwords scope.
• A production access level — Explorer or Basic — because a new project only reaches test accounts.

Step 1 — Create the Cloud project and enable the API

1. Sign in to the Google Cloud Console with the Google account that manages your ads and create a project.
2. Open APIs & Services → Library, search for "Google Ads API" and click Enable.

Enabling the API grants the project Test access automatically. Test access reaches test accounts only; a call to a production account from a Test-level project fails — in API version 25 with the error CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION.

Step 2 — Configure the OAuth consent screen, then publish it

1. APIs & Services → OAuth consent screen (newer consoles call it Google Auth Platform). Choose External, give the app a name and your contact emails.
2. Add the Google account you will sign in with as a test user.
3. Click Publish app.

The publishing step matters: while the app is in "Testing", Google issues refresh tokens that expire after seven days, so your integration would need to be re-authorised every week. Publishing your own app for your own use needs no verification; Google shows a "Google hasn't verified this app" screen that you pass through with Advanced → Go to (app name).

Step 3 — Create the OAuth client

1. APIs & Services → Credentials → Create credentials → OAuth client ID.
2. Application type: Web application. Add the exact redirect URI your software uses (for a tool on your own PC it is typically an http://localhost/… address; on hosting it starts with https).
3. Copy the client ID and client secret into your software.

Step 4 — Request a production access level

In the Cloud Console open APIs & Services → Google Ads API (the API's Overview page). It shows the project's current level and an "Upgrade access level" panel. Google's access-levels page describes four levels:

For reading reports from your own account, Explorer is enough: reporting through GoogleAdsService.SearchStream is not on its restricted-feature list, and a daily sync uses a handful of operations. Apply for Basic when you need more operations or the planning services (keyword ideas, reach planning).

Step 5 — Make the calls

Every request carries the OAuth access token in the Authorization: Bearer header. Requests on behalf of a manager account add login-customer-id with the manager's ID (digits only). The developer-token header is now optional: Google says you "can continue sending developer tokens in your API call headers, but this is optional and ignored by the API servers", and warns that a future major version will reject them. Use the current major version in the URL — /v25/ at the time of writing — and plan to bump it, since Google retires each major version roughly a year after release.

Two endpoints cover a reporting integration: GET /v25/customers:listAccessibleCustomers to find the accounts the signed-in user can see, and POST /v25/customers/{id}/googleAds:searchStream with a GAQL query for the figures (for example daily campaign cost, clicks, conversions and conversion value).

Step 6 — Errors you may meet

• CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION — the project is still at Test access; request Explorer or Basic.
• invalid_grant / "Token has been expired or revoked" at the token endpoint — the consent screen is still in Testing (7-day tokens), the user revoked access, or the token was unused for six months. Publish the app and re-authorise.
• redirect_uri_mismatch — the redirect URI in the request is not registered on the OAuth client, character for character.
• Silent fall-back to Test level — your OAuth credentials come from a different Cloud project than the one that holds the access level. Use one project for both.
• Google also notes known issues at the time of writing: projects on a free trial or with a suspended billing account have been rejected for Basic or Explorer access, and some projects upgraded after 9 September 2026 saw an AUTHORIZATION_ERROR on production calls while a fix was rolling out.

Frequently asked

Do I still need a manager (MCC) account?

Not to obtain access — that is now the Cloud project's job. You still use a manager account if you reach client accounts through one, in which case the login-customer-id header is required.

Is this free?

Yes. Google Cloud projects and the Google Ads API have no charge for this use; what costs money is the advertising itself.

How does this apply to a self-hosted tool?

Exactly as above: the buyer creates their own Cloud project and OAuth client and pastes the client ID and secret into the tool. Our AI Ads Planner does this on its Integrations page with a "Connect Google Ads" button, reads reports through searchStream only, and its guide walks through these steps with the error messages mapped to fixes.

Sources

• Google Ads API — Developer token (sunset notice, optional header, known issues)
• Google Ads API — Access levels and permissible use
• Google Ads API — REST authentication and headers
• Google Ads API — OAuth2 internals

Checked against Google's documentation on 10–11 October 2026. Menu names in the Cloud Console change; the sequence does not.