Google Ads Permissions
The Google Ads connector requires a certain level of access both on the Google API side (OAuth scope) and at the level of the Google Ads account itself.
OAuth Scope
| Scope | Purpose | Required |
|---|---|---|
google_ads_read | Read Google Ads API data | Required |
This scope covers all read operations: campaigns, ad groups, keywords, search terms, statistics, and conversions.
Important: LightLead requests the minimum necessary set of permissions — read-only. Writing data to Google Ads is not required.
Access Levels in Google Ads
Access to data at the Google Ads account level is determined by the user's role:
| Role | Report access | Billing access | Management access |
|---|---|---|---|
| Admin | Full | Full | Full |
| Standard | Full | Limited | Limited |
| Read-only | Full | No | No |
| Reporting | Reports only | No | No |
| Email only | No | No | No |
"Read-only" is sufficient for LightLead, but the "Standard" role is recommended to get the full volume of data.
Configuring Access Permissions
For a Regular Account
- Sign in to Google Ads
- Go to Tools → Account Access
- Click + to add a user
- Enter the email of the user who will be connecting
- Select the access level
For a Manager Account (MCC)
- Sign in to the Manager account
- Go to Tools → Account Access
- Make sure the user has access to the necessary child accounts
- Access levels are configured individually for each child account
Checking Permissions
Via the Google Ads Interface
- Tools → Account Access
- Find the user in the list
- Check their access level
Via the Google API
Use the Google OAuth 2.0 Playground to check the active scopes of your token.
Notes
- Multiple accounts: a single Google account can have access to multiple Google Ads accounts
- Manager accounts: if a Manager account (MCC) is connected, access to child accounts is determined by settings within the MCC
- Token lifetime: Google OAuth tokens require periodic refresh — LightLead does this automatically