Connect Google Ads to Rig

How the connection works

Rig provisions a service account for your workspace: a Google identity that belongs to Rig and exists only to read your data. You add its email address to your Google Ads account as a read-only user, exactly as you would add a colleague.

That is the whole model, and it is why this connector is quicker than most. Sharing in means there is no OAuth consent screen to click through and no Google app verification to wait on. It also means the permission is visible in your own account and you can revoke it from there at any time, without involving Rig.

The key material for that service account is held by Rig and never leaves it. You never see it, download it or paste it.

Before you start

• Access to Admin → Access and security on the Google Ads account. Standard or admin access is enough; you do not need to be the billing owner.
• Your Google Ads account ID, the 10-digit number at the top right of the account. Rig wants the digits only, no dashes.
• If the account is run through a Manager account (Google calls it an MCC), that manager's 10-digit ID too. Adding Rig at the manager level covers every account beneath it in one step.

Generate your Rig service account

The service account is generated once for your whole workspace, not once per connector. If you have already generated one for another Google source, reuse that same email address and skip to the next section.

1. In Rig, open Connections and go to Sources & actions.
2. In the Google service account card at the top of the page, click Generate service account.
3. Copy the email address Rig gives you. It ends in .iam.gserviceaccount.com.

Connections → Sources & actions: the Google service account card sits above the connector grid.

Grant Rig read-only access

1. In Google Ads, go to Admin → Access and security → Users and click +.
2. Paste the service-account email and set the access level to Read only.
3. Send the invitation. Service accounts are added instantly: there is no invite email for anyone to accept, so if you are waiting for one, you are waiting for nothing.

Connect it in Rig

1. Back in Rig, open Connections and go to Sources & actions.
2. Search for Google Ads and open the card.
3. Google Ads account ID: the 10 digits, no dashes.
4. Manager account ID: leave blank unless the account sits under an MCC.
5. Developer token: leave blank. Rig supplies one, and the troubleshooting section below explains why your own will not work here.
6. Click Test to pull a small sample, then Sync to run the full pipeline.

What Rig pulls in

Google Ads lands in its own google_ads schema in your warehouse, and stays current with incremental syncs.

• Campaigns, with daily cost, impressions, clicks and conversion metrics
• Ad groups
• Keywords
• Search terms, the queries people actually typed
• Asset groups, the Performance Max equivalent of an ad group
• Products, shopping performance by item

What Performance Max will not give you

Two things people reasonably expect from Performance Max are not available to any tool, Rig included, because Google does not expose them through the API:

• The split of Performance Max spend across YouTube, Search, Display and Discover
• Raw Performance Max search terms

This is a deliberate limit of the Google Ads API rather than a gap in the connector, so no reporting tool can show you those numbers today. Asset group performance is available, and that is the closest usable substitute.

Troubleshooting

• Google Ads says the email does not match a Google Account: do not keep retrying, and check the address is not mistyped only once. This is almost always a restriction on your Ads account rather than a typo. Look at Access and security → Security → Allowed domains: if that list is turned on, it blocks the service account's domain. Either add the domain, or email product@rig.so and we will connect the account over OAuth instead.
• Permission denied, and the error mentions the manager account: Google's message names login-customer-id whenever access fails, even when the real cause is that nobody has added the service account yet. Check the grant exists in Access and security before changing the manager ID.
• You pasted your own developer token and it fails: Google permanently pairs each Cloud project with the first developer token it uses. A token of your own only works alongside OAuth client credentials from your own Cloud project, so on this path it fails with DEVELOPER_TOKEN_PROHIBITED even though your account access is perfectly correct. Leave the field blank.
• Numbers look low against the Ads UI: check the date range first. Recent days move for about 30 days as conversions attribute retroactively.

If you would rather authenticate with your own OAuth client than share in, Rig accepts a client ID, client secret and a refresh token minted with this scope:

On that path you supply your own developer token as well, because it has to come from the same Cloud project as the OAuth client. Google refresh tokens do not rotate or expire in use, so it is a one-time setup, but the read-only user above is faster and easier to audit.