Google Ads

Open Settings → Integrations → Google Ads and click Connect with Google. Complete the OAuth consent flow with a Google user that can access the ad accounts you want ShopMCP to query.

Google will ask for the Google Ads API scope:

• https://www.googleapis.com/auth/adwords — this is the only scope required for Google Ads API access

You do not need to create a Google Cloud project, enable the API, edit an OAuth consent screen, or apply for a developer token. ShopMCP owns the Google Cloud OAuth client and the shared Google Ads developer token.

After consent, ShopMCP lists:

• Direct accounts the Google user can access
• Manager accounts (MCCs) available to the Google user
• MCC child accounts discovered through customer_client

Select one or more accounts to expose. ShopMCP stores the OAuth tokens encrypted-at-rest, records the selected customer id and optional login-customer-id for MCC access, and flips the Google Ads module to Connected for every API key in the workspace.

ShopMCP's Google Ads package includes four write tools — google_ads_pause_campaign, google_ads_resume_campaign, google_ads_update_campaign_budget, and google_ads_add_negative_keyword. These are implemented but gated. They register only when the workspace write toggle is enabled and the integration's rollout mode allows Google Ads writes.

Each write tool is locked to a hand-written, field-level input allowlist. For example, google_ads_update_campaign_budget accepts amount_micros and delivery_method — and nothing else. Campaign strategy changes, bid adjustments, and audience modifications are all rejected at the input schema layer before any HTTP request is built. This is deliberate: if a prompt injection convinces the LLM to call the tool with disallowed fields, the Zod validator drops the request on the floor.

Current Google Ads writes cover pause, resume, shared-budget update, and campaign-level negative keyword creation. Broader keyword, bidding, audience, and conversion-action mutates stay out of scope until dedicated sandbox smoke coverage exists.

Google OAuth access tokens expire after approximately one hour. ShopMCP automatically refreshes them using the stored refresh token — the same mechanism used by the GA4 and Google Search Console modules. No manual intervention is needed unless the refresh token itself is revoked (e.g. the user removes ShopMCP from their Google account permissions).

If the refresh token is revoked, ShopMCP will surface a "Google OAuth token expired" error. Reconnect by clicking Connect with Google again to re-authorize.

• PERMISSION_DENIED — the authenticated Google account does not have access to the selected Customer ID. Verify that the account you signed in with has at least read access to the ad account in Google Ads, directly or through the selected MCC.
• DEVELOPER_TOKEN_NOT_APPROVED— ShopMCP's shared developer token is still at Test Account level or needs operator attention. Contact ShopMCP support; workspace users do not need their own developer token.
• CUSTOMER_NOT_FOUND— the Customer ID is incorrect or the account has been cancelled. Double-check the 10-digit ID in the Google Ads UI. If you're using an MCC, make sure the Login Customer ID is also set correctly.
• Rate limit exceeded (RESOURCE_EXHAUSTED) — Google Ads enforces per-developer-token rate limits. ShopMCP does not retry automatically on rate limit errors by design. Wait a few minutes and try again. If this is persistent, check your Google Ads API dashboard for quota usage.
• "Google OAuth token expired" — the refresh token was revoked. Re-authorize by clicking Connect with Google on the integration page.