Google launches secure API access pilot for manager accounts

08/05/26
Source: Search Engine Land by Anu Adegbola. Read the original article

TL;DR Summary of Google Introduces Enhanced Security Controls for Google Ads API Access

Google is piloting a new security feature that limits sensitive Google Ads API actions to a pre-approved allowlist of trusted applications. This initiative aims to provide manager account owners with greater control and visibility over third-party tools accessing their accounts. The feature enhances protection against unauthorized access even if API credentials are compromised. Agencies and large advertisers benefit from improved security and streamlined management of connected applications.

Optimixed’s Overview: Strengthening Google Ads API Security with Controlled Access for Manager Accounts

Introduction to the New Google Ads API Security Pilot

Google has launched a pilot program to bolster the security of sensitive operations within the Google Ads API. This initiative focuses on empowering manager account owners by restricting high-risk actions — such as account management, user administration, and billing — to a curated allowlist of Google Cloud projects.

How the Allowlist System Works

  • Enrollment: Developers submit their top-level Google Ads manager account customer ID to join the pilot.
  • Audit and Identification: Google audits API activity across the account hierarchy to identify all connected applications.
  • Allowlist Creation: Collaborating with advertisers, Google establishes a list of approved third-party tools authorized to perform sensitive API methods.
  • Access Restriction: Applications not on the allowlist are blocked from executing sensitive API requests, safeguarding against unauthorized actions.
  • Ongoing Management: Advertisers can request approval for new apps, and newly linked accounts inherit the manager account’s security protections automatically.

Why This Matters for Advertisers and Agencies

Many large advertisers and agencies rely on multiple third-party tools to manage their Google Ads accounts efficiently. The new allowlist feature:

  • Provides an extra layer of security by ensuring only trusted applications can access critical API functions.
  • Mitigates risks even if API credentials are leaked or compromised.
  • Improves transparency and control over which external software interacts with Google Ads accounts.

Context within Google’s Broader Security Enhancements

This pilot complements Google’s ongoing efforts to enhance account security, such as the recent introduction of mandatory passkey authentication for Google Ads API users. By tightening access controls and enhancing verification, Google aims to protect sensitive advertising account operations from unauthorized use while maintaining seamless integration with external tools.

Conclusion

Google’s new pilot for managing API access through an allowlist offers a significant advancement in protecting sensitive Google Ads account functions. Manager account owners gain improved oversight and control, helping secure their advertising environments against unauthorized actions.