OAuth is the mechanism behind every legitimate "Sign in with Google" button: you approve a consent screen, and an application receives tokens that let it act on your behalf — within a listed scope, without ever seeing your password. For Google Ads, the scope in question is the Google Ads API scope (https://www.googleapis.com/auth/adwords), and the consent screen is a contract most people approve without reading. Here is exactly what it grants — and what it can never reach.
How the OAuth grant works
The flow has three moves. You click sign-in and land on Google's own pages — the application is not involved while you type your password or pass two-factor checks. Google shows the consent screen naming the app and the scopes it requests. You approve, and Google hands the app two tokens: a short-lived access token it uses for API calls, and a long-lived refresh token it uses to mint new access tokens without asking you again.
From then on, every API call the app makes is stamped with your identity. In Google Ads change history, its changes arrive as API changes made under your user — the same attribution as if you had made them, because in the permission model, you did.
What the adwords scope covers — and what it can never reach
The Google Ads API scope is account-wide and binary: it covers the Google Ads accounts your login can access, for reads and for the writes the API supports — campaigns, budgets, keywords, reports. Google does not offer a read-only or per-account variant of the scope. Two things follow. First, take any app requesting it seriously. Second, finer control has to come from the layer above — the connector — which is where per-account scoping actually lives.
Just as firm is what the grant cannot touch:
- Your password and sign-in. The app cannot log in as you, satisfy two-factor prompts, or outlive your revocation.
- Other Google services. Gmail, Drive, Docs, Analytics — each needs its own scope, named on its own consent screen. The adwords scope grants none of them.
- Your payment details. The cards and bank accounts behind your billing live in your Google payments profile, behind its own sign-in — not reachable through an Ads API grant.
Why the verification badge matters
Google reviews apps that request sensitive scopes, and the adwords scope is one. An unverified app throws a full-screen warning before consent — you proceed only past deliberately alarming text. Verification means Google has reviewed the app's identity and its stated use of the scope. It is not a security audit of the vendor, but it is a floor: a connector that asks for your ad account without having cleared Google's review is asking you to accept risk its publisher would not submit for inspection. AdCopilot's adwords scope is Google-verified; treat that as the minimum bar for the category, then ask the harder credential-custody questions.
Why OAuth keeps AI access legible and revocable
OAuth is what lets an AI assistant run your Google Ads account — building campaigns, moving budgets, adding keywords, on your command — while keeping that access both legible and revocable. Legible, because every move the agent makes runs under your identity and lands in change history attributed to you — no shared logins, no mystery service accounts. Revocable, because the grant is a line item in your Google account's third-party access list: remove it there and the tokens die, whatever the vendor does or fails to do.
Two levels of control, then. Google decides whether the app may call the API at all — the grant. The connector decides which accounts and which tools that access actually reaches — the scoping. Use both, and rehearse the exit before you need it: revoking AI access takes under a minute.