Authentication

Authentication

The Google Ads MCP server needs OAuth credentials. The Ad Creative MCP server needs Cloudinary keys. Both pull values from environment variables — never from the plugin source.

Google Ads OAuth — what you need

Variable	Where to get it
GOOGLE_ADS_DEVELOPER_TOKEN	Google Ads → Tools & Settings → API Center. Requires a manager (MCC) account.
GOOGLE_ADS_CLIENT_ID	Google Cloud Console → APIs & Services → Credentials. Create an OAuth 2.0 Client ID (Desktop).
GOOGLE_ADS_CLIENT_SECRET	Same screen as the Client ID.
GOOGLE_ADS_REFRESH_TOKEN	Run the OAuth flow — see below.
GOOGLE_ADS_LOGIN_CUSTOMER_ID	Your MCC ID (10 digits, no dashes).
GOOGLE_ADS_CUSTOMER_ID	Optional — pin a specific account to operate on by default.

Quick OAuth flow (3 minutes)

The easiest path is the hosted OAuth flow at ahmeego.com/docs/google-ads-auth — it returns a refresh token directly.

If you prefer a local flow, the google-ads-mcp repo has a scripts/get_refresh_token.py helper:

git clone https://github.com/itallstartedwithaidea/google-ads-mcp
cd google-ads-mcp
pip install -r requirements.txt
python scripts/get_refresh_token.py
# Opens a browser, sign in, paste the token back into your .env

Cloudinary setup (optional, for ad-creative MCP)

1. Sign up free at cloudinary.com.
2. Go to Dashboard → copy Cloud name, API Key, API Secret.
3. Set:

CLOUDINARY_CLOUD_NAME=your_cloud_name
CLOUDINARY_API_KEY=your_api_key
CLOUDINARY_API_SECRET=your_api_secret

If Cloudinary isn't set, the ad-creative MCP server starts in degraded mode (validation only, no resize/optimize).

Where to put the env vars

Claude Code resolves ${VAR} references in .mcp.json against the parent process's environment. So you have two options:

Option A — .env file at the plugin install location

After install, the plugin lives at ~/.claude/plugins/cache/<marketplace>/googleadsagent/<sha>/. Create a .env there.

Option B — export in your shell profile (recommended)

Add to ~/.zshrc (or ~/.bashrc):

export GOOGLE_ADS_DEVELOPER_TOKEN=...
export GOOGLE_ADS_CLIENT_ID=...
export GOOGLE_ADS_CLIENT_SECRET=...
export GOOGLE_ADS_REFRESH_TOKEN=...
export GOOGLE_ADS_LOGIN_CUSTOMER_ID=...
export CLOUDINARY_CLOUD_NAME=...
export CLOUDINARY_API_KEY=...
export CLOUDINARY_API_SECRET=...

Then source ~/.zshrc and restart Claude Code.

Verifying

After setting credentials and restarting Claude Code:

> Hey Buddy, can you confirm you have Google Ads API access? Run a simple query against my MCC.

If Buddy can list your accessible customer IDs, you're set.

Troubleshooting

Symptom	Likely cause	Fix
developer_token is missing	Env var not set	Confirm with echo $GOOGLE_ADS_DEVELOPER_TOKEN
invalid_grant from refresh token	Token expired (rare) or revoked	Re-run the OAuth flow
customer is not in approved status	MCC isn't approved yet	Apply for production access in API Center
User has no access to customer XXX	Wrong GOOGLE_ADS_LOGIN_CUSTOMER_ID	Use the MCC ID, not the sub-account ID
uvx: command not found	Missing uv	curl -LsSf https://astral.sh/uv/install.sh | sh
npx: command not found	Missing Node	Install Node 18+

Security notes

• Never commit .env files.
• developer_token, client_secret, and refresh_token are equivalent to your account password — treat them as such.
• Buddy and the sub-agents won't echo these values back to chat. If you ever see them in a response, report it.