To discuss and provide feedback on our products, join the official Google Ads Discord channel in the Google Advertising and Measurement Community server.

Multi User Authentication Workflow

AI-generated Key Takeaways

To access the Google Ads API, configure your application to authenticate for the https://www.googleapis.com/auth/adwords scope.
It is recommended to request OAuth offline access to make API calls on behalf of the user while they are offline.
You should go through the OAuth App verification process and get your app certified.
Once you obtain OAuth 2.0 credentials after authorizing a user, you can configure your client library using those credentials to make API calls to their accounts.

In the multi-user authentication workflow, you build your own OAuth flow to authenticate your users. There are multiple app types discussed as part of the Google Identity documentation , and the Google Cloud Console project configuration you need to support that app type. All these app types are supported by Google Ads API. The additional technical details to keep in mind are:

To access Google Ads API, you should configure your application to authenticate for the following scope:
```
 https://www.googleapis.com/auth/adwords 
```
Your app may have to make API calls on behalf of the user while they are offline. A common scenario is to download account metrics offline to generate reports and perform account analytics. For this reason, we recommend requesting OAuth offline access .
You should go through the OAuth App verification process and get your app certified.

Client library configuration

Once you authorize the user and obtain OAuth 2.0 credentials, you can configure the client library by following the instructions on the tab corresponding to your programming language.

Java

You can initialize your GoogleAdsClient instance at runtime, using the credentials you have obtained from the user whose accounts you are making API calls to.

  UserCredentials 
  
 credentials 
  
 = 
  
 UserCredentials 
 . 
 newBuilder 
 () 
  
 . 
 setClientId 
 ( 
 OAUTH_CLIENT_ID 
 ) 
  
 . 
 setClientSecret 
 ( 
 OAUTH_CLIENT_SECRET 
 ) 
  
 . 
 setRefreshToken 
 ( 
 REFRESH_TOKEN 
 ) 
  
 . 
 build 
 (); 
 // Creates a GoogleAdsClient with the provided credentials. 
 GoogleAdsClient 
  
 client 
  
 = 
  
 GoogleAdsClient 
 . 
 newBuilder 
 () 
  
 // Sets the developer token which enables API access. 
  
 . 
 setDeveloperToken 
 ( 
 DEVELOPER_TOKEN 
 ) 
  
 // Sets the OAuth credentials which provide Google Ads account access. 
  
 . 
 setCredentials 
 ( 
 credentials 
 ) 
  
 // Optional: sets the login customer ID. 
  
 . 
 setLoginCustomerId 
 ( 
 Long 
 . 
 valueOf 
 ( 
 LOGIN_CUSTOMER_ID 
 )) 
  
 . 
 build 
 (); 
 ``` 
  
 See 
  
 the 
  
 [ 
 configuration 
  
 guide 
 ][ 
 java 
 - 
 config 
 - 
 guide 
 ] 
  
 for 
  
 additional 
  
 options 
 .

.NET

You can initialize your GoogleAdsClient instance at runtime, using the credentials you have obtained from the user whose accounts you are making API calls to.

  GoogleAdsConfig 
  
 googleAdsConfig 
  
 = 
  
 new 
  
 GoogleAdsConfig 
 () 
 { 
  
 DeveloperToken 
  
 = 
  
 DEVELOPER_TOKEN 
 , 
  
 LoginCustomerId 
  
 = 
  
 LOGIN_CUSTOMER_ID 
 , 
  
 OAuth2ClientId 
  
 = 
  
 OAUTH_CLIENT_ID 
 , 
  
 OAuth2ClientSecret 
  
 = 
  
 OAUTH_CLIENT_SECRET 
 , 
  
 OAuth2RefreshToken 
  
 = 
  
 REFRESH_TOKEN 
 , 
 }; 
 GoogleAdsClient 
  
 googleAdsClient 
  
 = 
  
 new 
  
 GoogleAdsClient 
 ( 
 googleAdsConfig 
 );

See the configuration guide for additional options.

Python

You can initialize your GoogleAdsClient instance at runtime, using the credentials you have obtained from the user whose accounts you are making API calls to.

  from 
  
 google.ads.googleads.client 
  
 import 
 GoogleAdsClient 
 credentials 
 = 
 { 
 "developer_token" 
 : 
 "INSERT_DEVELOPER_TOKEN_HERE" 
 , 
 "login_customer_id" 
 : 
 "INSERT_LOGIN_CUSTOMER_ID_HERE" 
 , 
 "refresh_token" 
 : 
 "REFRESH_TOKEN" 
 , 
 "client_id" 
 : 
 "OAUTH_CLIENT_ID" 
 , 
 "client_secret" 
 : 
 "OAUTH_CLIENT_SECRET" 
 } 
 client 
 = 
 GoogleAdsClient 
 . 
 load_from_dict 
 ( 
 credentials 
 )

See the configuration guide for additional options.

PHP

You can initialize your GoogleAdsClient instance at runtime, using the credentials you have obtained from the user whose accounts you are making API calls to.

  $oAuth2Credential = (new OAuth2TokenBuilder()) 
 ->withClientId('INSERT_CLIENT_ID_HERE') 
 ->withClientSecret('INSERT_CLIENT_SECRET_HERE') 
 ->withRefreshToken('INSERT_REFRESH_TOKEN_HERE') 
 ->build(); 
 $googleAdsClient = (new GoogleAdsClientBuilder()) 
 ->withOAuth2Credential($oAuth2Credential) 
 ->withDeveloperToken('INSERT_DEVELOPER_TOKEN_HERE') 
 ->withLoginCustomerId('INSERT_LOGIN_CUSTOMER_ID_HERE') 
 ->build();

See the configuration guide for additional options.

Ruby

You can initialize your GoogleAdsClient instance at runtime, using the credentials you have obtained from the user whose accounts you are making API calls to.

   
 client 
  
 = 
  
 Google 
 :: 
 Ads 
 :: 
 GoogleAds 
 :: 
 GoogleAdsClient 
 . 
 new 
  
 do 
  
 | 
 config 
 | 
  
 config 
 . 
 client_id 
  
 = 
  
 'INSERT_CLIENT_ID_HERE' 
  
 config 
 . 
 client_secret 
  
 = 
  
 'INSERT_CLIENT_SECRET_HERE' 
  
 config 
 . 
 refresh_token 
  
 = 
  
 'INSERT_REFRESH_TOKEN_HERE' 
  
 config 
 . 
 login_customer_id 
  
 = 
  
 'INSERT_LOGIN_CUSTOMER_ID_HERE' 
  
 config 
 . 
 developer_token 
  
 = 
  
 'INSERT_DEVELOPER_TOKEN_HERE' 
  
 end

See the configuration guide for additional options.

Perl

You can initialize your GoogleAdsClient instance at runtime, using the credentials you have obtained from the user whose accounts you are making API calls to.

  my 
  
 $api_client 
  
 = 
  
 Google::Ads::GoogleAds:: 
 Client 
 - 
> new 
 ({ 
  
 developer_token 
  
 = 
>  
 "INSERT_DEVELOPER_TOKEN_HERE" 
 , 
  
 login_customer_id 
  
 = 
>  
 "INSERT_LOGIN_CUSTOMER_ID_HERE" 
 }); 
 my 
  
 $oauth2_applications_handler 
  
 = 
  
 $api_client 
 - 
> get_oauth2_applications_handler 
 (); 
 $oauth2_applications_handler 
 - 
> set_client_id 
 ( 
 "INSERT_CLIENT_ID" 
 ); 
 $oauth2_applications_handler 
 - 
> set_client_secret 
 ( 
 "INSERT_CLIENT_SECRET" 
 ); 
 $oauth2_applications_handler 
 - 
> set_refresh_token 
 ( 
 "INSERT_REFRESH_TOKEN" 
 );

See the configuration guide for additional options.

curl

Start by using an HTTP client to fetch an OAuth 2.0 access token. This guide uses the curl command.

 curl  
 \ 
  
--data  
 "grant_type=refresh_token" 
  
 \ 
  
--data  
 "client_id= CLIENT_ID 
" 
  
 \ 
  
--data  
 "client_secret= CLIENT_SECRET 
" 
  
 \ 
  
--data  
 "refresh_token= REFRESH_TOKEN 
" 
  
 \ 
  
https://www.googleapis.com/oauth2/v3/token

You can now use the access token in your API calls. The following example shows how to run a campaign report using the GoogleAdsService.SearchStream method to retrieve the campaigns in your account. This guide doesn't cover the details of reporting .

 curl  
-i  
-X  
POST  
https://googleads.googleapis.com/v22/customers/ CUSTOMER_ID 
/googleAds:searchStream  
 \ 
  
-H  
 "Content-Type: application/json" 
  
 \ 
  
-H  
 "Authorization: Bearer ACCESS_TOKEN 
" 
  
 \ 
  
-H  
 "developer-token: DEVELOPER_TOKEN 
" 
  
 \ 
  
-H  
 "login-customer-id: LOGIN_CUSTOMER_ID 
" 
  
 \ 
  
--data-binary  
 "@query.json"

The contents of query.json are as follows:

  { 
  
 "query" 
 : 
  
 "SELECT campaign.id, campaign.name, campaign.network_settings.target_content_network FROM campaign ORDER BY campaign.id" 
 }

Single-user authentication workflow

Handling two-step verification

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License , and code samples are licensed under the Apache 2.0 License . For details, see the Google Developers Site Policies . Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-11-05 UTC.

Create a Mobile Website

View Site in Mobile | Classic

Share by: