Managing Google Ads Programmatically — API, Scripts, and MCC, and Where an Agent Needs a Human Checkpoint

For a marketer's AI agent, this is the page that decides HOW it is allowed to touch an account: as a human clicking automated rules, as a script running inside Google's environment, or as external software calling the API — each with a different setup cost, capability ceiling, and policy obligation. Picking the wrong tier either blocks you on access-level limits or gets the token revoked for violating Google Ads Policy Taxonomy: What Gets an Ad Disapproved vs an Account Suspended.

Google Ads API vs Google Ads Scripts vs the UI: Three Different Tools

- Google Ads API: "the programmatic interface to Google Ads, used for managing large or complex Google Ads accounts and campaigns" — for developers building software from customer level down to individual keywords, running on the developer's own infrastructure. It supports Java, PHP, Python, .NET, Ruby, and Perl client libraries, and can be called via gRPC or JSON REST (source: developers.google.com/google-ads/api/docs/get-started/introduction; support.google.com/google-ads/answer/2375503). Typical uses: automated account management, custom reporting, inventory-based ad management, Smart Bidding strategies. - Google Ads Scripts: "a way to programmatically manage and query your Google Ads data using JavaScript in a browser-based IDE" (developers.google.com/google-ads/scripts/docs/start). Only entry-level JavaScript is needed; the IDE gives syntax highlighting, auto-complete, and preview. Scripts run inside Google's environment — no servers or databases to manage — support mutate/search operations across most campaign types (Search, Display, Shopping, Video, Performance Max, etc.), integrate external data sources, and can schedule tasks without an active user session. Scripts can also run across multiple accounts through manager-account access ("manager scripts"). - Automated rules: no-code, UI-based. They "make automatic account changes based on chosen settings and conditions" — changing ad status, budget, or bids, or sending an automated email (support.google.com/google-ads/answer/2472779). (unverified) — no specific execution turnaround time is documented in the cited source; do not assume near-real-time execution. - Non-technical alternatives Google itself points to: BigQuery Data Transfer for analysts who need reporting without code, and bulk uploads / Google Ads Editor / automated rules for anyone who doesn't want to write code at all (developers.google.com/google-ads/api/docs/get-started/introduction).

Which to pick

rules for simple conditional actions with no code; Scripts for developers who want programmatic control but no infrastructure to run/host; the API for large-scale or sophisticated operations requiring the advertiser's own software stack.

Access Prerequisites: Developer Token, OAuth, and Access Levels

Using the API (not Scripts, not rules) requires:

- A developer token: a 22-character alphanumeric string that lets an app connect to the Google Ads API. It is obtained from the API Center inside a Google Ads manager account — you must select or create a manager account and apply via API Center, providing company name, functional website URL, and an actively monitored API contact email (developers.google.com/google-ads/api/docs/api-policy/developer-token). Every API call sends this token as the developer-token HTTP or gRPC header. - OAuth 2.0: the authentication mechanism, with OAuth 2.0 credentials (including refresh tokens) authenticating the user's identity. The API does not use separate OAuth scopes to restrict functionality — it follows Google Ads' own built-in user roles instead (Standard Access, Readonly, etc.) (developers.google.com/google-ads/api/docs/oauth/access-model). - Access levels, which gate how much the token can do: - *Test Account Access* — entry tier, test accounts only, up to 15,000 operations/day. - *Basic Access* — test and production accounts, still capped at 15,000 operations/day; review typically takes 5 business days. - *Standard Access* — removes the operation cap ("unlimited operations per day for most services"); review typically takes 10 business days. (developers.google.com/google-ads/api/docs/api-policy/access-levels)

Cost

the API itself is free to use at both Basic and Standard Access — there are no usage charges (same source).

MCC (Manager Accounts): One Login, Many Accounts

A manager account (MCC) "lets you easily view and manage multiple Google Ads accounts" from a single login and dashboard: search/navigate all linked accounts, create and manage campaigns for them, and generate multi-account reports (support.google.com/google-ads/answer/6139186). Manager accounts can be structured as a tree — a top-level manager can branch into other managers, which branch into individual accounts — and Google's own guidance is that a manager account is "probably the best option if you're managing more than 20 accounts."

Linking an account

go to Sub-account settings → plus button → "Link existing account" → enter the Customer ID → send the request. The recipient must have either administrative access to the invited account, or access to a linked manager account with administrative ownership of it, to accept. Once accepted, "the account will then appear in your manager account automatically" (support.google.com/google-ads/answer/7459601).

Permission limits

the original account owner keeps normal access and can unlink at any time; a manager account cannot change proprietary details like sign-in credentials unless it holds ownership status (support.google.com/google-ads/answer/6139186).

This is the same infrastructure an agency (or an agent acting for one) uses to operate many client accounts from one credential set, and it composes with either Scripts (manager scripts) or the API (developer token issued from the manager account).

Automated Rules vs Scripts vs API: Trade-offs

| | Automated rules | Scripts | API | |---|---|---|---| | Code required | No | Yes (JavaScript, entry-level) | Yes (any of Java/PHP/Python/.NET/Ruby/Perl) | | Runs where | Google's UI/backend | Google's environment | Your own infrastructure | | Examples of what it does | Schedule ads on/off for promos or weekly patterns; pause underperforming keywords/ads on cost-per-conversion or CTR; adjust bids by time of day (e.g. +25% 6–10 PM); email alerts and budget/campaign pausing on spend thresholds | All the above plus custom logic across campaign types, external data integration, scheduled unattended runs, multi-account "manager scripts" | Full programmatic control from customer level to individual keyword; the substrate large/complex operations and Smart Bidding integrations are built on | | Turnaround | Not immediate; exact timing undocumented (unverified) | Immediate (developer-controlled schedule) | Immediate (developer-controlled) | | Best for | Non-technical users, simple conditional actions | Developers avoiding infrastructure overhead who still want programmatic control | Developers/agencies building their own software with servers/databases for large-scale or sophisticated operations |

Sources: support.google.com/google-ads/answer/2497710 (rules use cases), support.google.com/google-ads/answer/2472779 (rules definition), developers.google.com/google-ads/scripts/docs/start, developers.google.com/google-ads/api/docs/get-started/introduction.

Safe-Automation Guardrails

Google's API policies constrain what programmatic access may be used for, and violating them risks the token, not just the account:

- The API may only be used "for Google Ads campaign creation, management, or reporting" (support.google.com/adspolicy/answer/6169371). - No shared tokens. Any automatic or programmatic use of Google Ads by agencies or end-advertiser clients requires *their own* Google Ads API token — a developer cannot let third parties use their token to make automated changes on the third party's behalf; each user must obtain their own token. - No silent automation for end users. End users must "manually sign in to use your tool, rather than having automatic access, to make manual or programmatic changes" — i.e. a tool cannot make programmatic changes to a user's account without that user actively signing in. - Explicitly prohibited: scraping TargetingIdeaService or TrafficEstimatorService for non-campaign purposes, scraping Google Search results, and requiring clients to use the developer's token instead of obtaining their own. - Enforcement: Google monitors compliance and may issue warnings before charging non-compliance fees, downgrading access levels, or revoking API tokens outright.

(unverified) — the notes searched did not find explicit Google guidance recommending a "human-review checkpoint" specifically for AI agents performing automated bidding or ad changes. What IS verified above is the token/consent framework (own token per user, manual sign-in required, no automated changes without it) that any agent-driven automation must satisfy regardless — this is the actual enforced guardrail, and it functions as a built-in checkpoint: no agent can act on an account it wasn't given a token and active user sign-in for.

Why this matters for the objective

this page is the operational gate between "the agent has a plan" (auction mechanics, campaign types, bidding strategy from the rest of this wiki) and "the agent can execute it without getting the account suspended" — see Google Ads Policy Taxonomy: What Gets an Ad Disapproved vs an Account Suspended for what crosses from disapproval into suspension, and Account Suspensions: Triggers, Verification, and the Appeal Process — the policy trap that can end a Google Ads account overnight for what happens if a token/account gets flagged anyway.

Related

- Google Ads Policy Taxonomy: What Gets an Ad Disapproved vs an Account Suspended — the policy line the "no shared tokens / no silent automation" rules above are downstream of; violating either can escalate to account-level consequences, not just a rejected API call. - Account Suspensions: Triggers, Verification, and the Appeal Process — the policy trap that can end a Google Ads account overnight — what to do if programmatic access (or the account behind it) gets suspended; relevant because misusing API/Scripts access is one of the triggers. - How to Launch Performance Max Without Cannibalizing Brand or Wasting Spend — a concrete case where Scripts/API-level control (campaign-level negative keywords, brand exclusions) is what a UI-only workflow can't easily automate at scale. - Bidding Strategies: Manual, Smart Bidding, and When Each Applies — matching the strategy to the conversion data you actually have — Smart Bidding strategies are exactly what large-scale API/Script automation is built to manage; this page's access-level and token setup is the prerequisite for touching them programmatically.