The short answer
HireOtto uses Google OAuth so you can authorize Google Ads access without giving HireOtto your Google password. You sign in on Google’s consent screen, approve the requested Google Ads permission, choose the accounts HireOtto should save, and return to your AI client.
That authorization is not a second Google Ads user role. Google Ads continues to apply the role already assigned to the connected Google identity. A read-only user can report but cannot edit. A Standard or Admin user can make supported changes when a user or workflow explicitly asks HireOtto to do so.
OAuth delegates access; it does not share your password
OAuth 2.0 is an authorization standard. In practical terms, Google handles the sign-in and consent step. HireOtto receives OAuth tokens representing the permission you approved, not your Google password.
Google’s authorization server issues a short-lived access token for API requests. When offline access is granted, a refresh token can obtain a new access token without asking you to sign in for every request. A refresh token can stop working if access is revoked, it expires, or an account policy invalidates it.
This distinction matters because three separate controls are involved:
Google verifies the identity signing in and records the consent.
Google Ads applies the connected identity’s account access and role.
HireOtto exposes only its supported Google Ads workflows and acts only when a user or configured workflow requests an action.
Connect the HireOtto Google Ads server to your MCP-compatible AI client.
Ask the client to connect or authenticate Google Ads.
Open the authorization URL returned by HireOtto and sign in with the Google identity that already has access to the required advertiser account or manager account.
Review Google’s consent screen and approve the Google Ads permission.
Select the accounts HireOtto should save, then choose SAVE. If you complete OAuth but skip this account-selection step, the connection can finish without any usable Google Ads accounts.
Return to the AI client and run a small read request, such as “List my accessible Google Ads accounts.” Confirm the account names and IDs before asking for a change.
There are two connections, not one
Connecting your AI client to HireOtto establishes the MCP connection. Authorizing Google Ads establishes the platform connection. Completing the first does not grant Google Ads access, and authorizing Google Ads does not automatically authorize Search Console, Tag Manager, or Analytics.
What the Google Ads permission actually allows
The OAuth scope supports Google Ads API access
Google Ads uses the adwords OAuth scope for API access. Unlike some Google APIs, it does not provide separate read-only and read-write OAuth scopes. The same scope can support both kinds of operation.
Your Google Ads role is the practical permission gate
The connected identity’s Google Ads role still governs what succeeds. Read-only access can view campaigns and account changes but cannot edit. Standard access can modify campaigns but cannot manage other users. Admin access adds user-management authority.
HireOtto’s current Google Ads server supports reporting and user-directed account changes. Whether a specific operation succeeds also depends on the selected account, campaign type, policy state, Google Ads API coverage, and the connected user’s permissions.
OAuth permission is not automatic campaign management
Approving Google Ads access makes supported operations possible; it does not tell HireOtto to run them. HireOtto does not change campaigns on its own. You or your AI workflow must request an action.
For budgets, targeting, bulk edits, and other high-impact changes, use a human review gate: verify the account ID, scope, dates, values, and proposed action before approval. Then confirm the result in Google Ads or change history.
How manager accounts and multiple Google logins work
When you connect a Google login, HireOtto includes direct Google Ads accounts and looks one level below any manager account it can see. This covers a typical agency MCC and its direct child accounts.
HireOtto does not automatically traverse every nested manager level. If the account you need sits below an inner MCC, connect a different Google identity with direct access to that inner manager. Multiple connected Google profiles are an Agency-plan feature.
If someone grants the connected identity access to a new account after setup, refresh the saved account list. New access is not discovered automatically until you request a refresh.
How to revoke, reconnect, or troubleshoot access
To revoke access
Open your Google Account’s third-party connections page, review HireOtto’s access, and remove it. HireOtto will no longer be able to use that Google authorization. You can reconnect later.
If HireOtto cannot see an account
Confirm you used the Google identity that can open the account in Google Ads.
Check whether access is direct or inherited through the manager account you expected.
If OAuth completed but no accounts appear, re-authenticate and make sure you select and save accounts.
If access was granted after setup, ask HireOtto to refresh the Google Ads accounts.
If a nested MCC is involved, connect a Google identity with more direct access to the inner manager.
If a request can read but not write
Check the connected identity’s Google Ads role first. The Google Ads API follows Google Ads roles; the OAuth consent screen does not upgrade a read-only user to Standard or Admin access.
A safe setup checklist for PPC teams
Use the Google identity whose access matches the intended job. Do not connect a broad Admin identity when read-only work is all you need.
Select only the advertiser and manager accounts the workflow needs.
Start with a small read request and verify the returned customer IDs.
Keep approval steps for budget, bidding, targeting, conversion, asset, and bulk changes.
Use Google Ads change history to verify important edits.
Remove third-party access when a contractor, client relationship, or workflow no longer needs it.
Document which Google identity owns each agency profile and who reviews high-impact changes.
Once Google Ads is authorized, HireOtto lets a supported AI client work with live account data through plain-language requests. It can list accessible accounts, report on performance, inspect campaigns and change history, export data, research keywords, and perform supported account-management actions.
For the OAuth workflow itself, HireOtto generates the authorization link, discovers accounts available to the connected identity, lets you select which accounts to save, and supports account refresh or re-authentication when access changes. For agencies, separate Google profiles can bridge access spread across multiple identities or nested manager structures, subject to the Agency plan.
The human stays responsible for choosing the right identity, approving Google’s consent, selecting accounts, reviewing requested changes, and verifying high-impact results. HireOtto cannot expand the connected Google user’s role, bypass account policies, or guarantee that every Google Ads setting is supported.
Continue with the Google Ads OAuth authentication guide, the connection guide, or the Google Ads quickstart. When you are ready, start with HireOtto.
Frequently asked questions
Does HireOtto receive my Google password?
No. Google handles sign-in and consent. HireOtto receives OAuth tokens for the Google Ads permission you approve.
Why does Google show a permission that can manage campaigns?
Google Ads uses one API scope rather than separate read-only and read-write scopes. Your Google Ads role still limits what the API can do, and HireOtto runs actions only when a user or workflow requests them.
Can I connect a read-only Google Ads user?
Yes. It can support reporting and inspection, but Google will reject edits because the connected identity lacks write permission.
Can HireOtto see every account under my MCC?
It includes the manager account and direct child accounts it can discover. For deeper nested managers, connect a Google identity with direct access to the relevant inner MCC.
What happens after I revoke access?
Requests that depend on that Google authorization stop working. Reconnect and reselect accounts if you want to restore access.
About Me
I’m Suyash – badminton junkie, ex‑GroupM ad‑ops grunt, first marketer at a B2B SaaS startup, and creator of Hiretto: MCP servers for performance marketers.
My mission: less clicking, more thinking.
Let’s build leverage together.
