--- title: "Connect Google Ads to Rig | Rig guide" description: "Add Rig as a read-only user on your Google Ads account, with no Cloud project and no consent screen. Syncs campaigns, ad groups, keywords, search terms and Performance Max reporting." canonical: "https://rig.so/guides/connect-google-ads" format: markdown --- Search guides, references, playbooks…⌘K Browse guides # Connect Google Ads to Rig Add one email address as a read-only user on your Google Ads account. Rig then syncs campaigns, ad groups, keywords, search terms and Performance Max reporting into your warehouse. Requirements Admin access to your org's Google Ads account Time required 5 mins ## How the connection works Rig provisions a **service account** for your workspace: a Google identity that belongs to Rig and exists only to read your data. You add its email address to your Google Ads account as a read-only user, exactly as you would add a colleague. That is the whole model, and it is why this connector is quicker than most. Sharing in means there is no OAuth consent screen to click through and no Google app verification to wait on. It also means the permission is visible in your own account and you can revoke it from there at any time, without involving Rig. The key material for that service account is held by Rig and never leaves it. You never see it, download it or paste it. ## Before you start - Access to `Admin` → `Access and security` on the Google Ads account. Standard or admin access is enough; you do not need to be the billing owner. - Your **Google Ads account ID**, the 10-digit number at the top right of the account. Rig wants the digits only, no dashes. - If the account is run through a **Manager account** (Google calls it an MCC), that manager's 10-digit ID too. Adding Rig at the manager level covers every account beneath it in one step. ## Generate your Rig service account New to Rig? Watch how to find Connections The service account is generated once for your whole workspace, not once per connector. If you have already generated one for another Google source, reuse that same email address and skip to the next section. 1. In Rig, open `Connections` and go to `Sources & actions`. 2. In the **Google service account** card at the top of the page, click `Generate service account`. 3. Copy the email address Rig gives you. It ends in `.iam.gserviceaccount.com`. ![The Sources and actions screen in Rig, with the Google service account card and its Generate service account button at the top.](https://rig.so/rig-generate-service-account.png)Connections → Sources & actions: the Google service account card sits above the connector grid. ## Grant Rig read-only access 1. In Google Ads, go to `Admin` → `Access and security` → `Users` and click `+`. 2. Paste the service-account email and set the access level to **Read only**. 3. Send the invitation. Service accounts are added **instantly**: there is no invite email for anyone to accept, so if you are waiting for one, you are waiting for nothing. Add it to the manager account to cover everything If you run several Ads accounts under one manager account, add Rig there instead of on each account. One grant covers every sub-account, and new accounts are covered as you create them. ## Connect it in Rig New to Rig? Watch how to find Connections 1. Back in Rig, open `Connections` and go to `Sources & actions`. 2. Search for **Google Ads** and open the card. 3. **Google Ads account ID**: the 10 digits, no dashes. 4. **Manager account ID**: leave blank unless the account sits under an MCC. 5. **Developer token**: leave blank. Rig supplies one, and the troubleshooting section below explains why your own will not work here. 6. Click `Test` to pull a small sample, then `Sync` to run the full pipeline. ## What Rig pulls in Google Ads lands in its own `google_ads` schema in your warehouse, and stays current with incremental syncs. - **Campaigns**, with daily cost, impressions, clicks and conversion metrics - **Ad groups** - **Keywords** - **Search terms**, the queries people actually typed - **Asset groups**, the Performance Max equivalent of an ad group - **Products**, shopping performance by item Conversions keep moving for about a month Google Ads attributes conversions retroactively, so yesterday's numbers are not final. Rig re-pulls a trailing 30 days on every sync to let those late conversions land. If you compare a Rig figure against the Google Ads UI for a recent date and they differ slightly, this is usually why, and the gap closes on its own. ## What Performance Max will not give you Two things people reasonably expect from Performance Max are not available to any tool, Rig included, because Google does not expose them through the API: - The split of Performance Max spend across YouTube, Search, Display and Discover - Raw Performance Max search terms This is a deliberate limit of the Google Ads API rather than a gap in the connector, so no reporting tool can show you those numbers today. Asset group performance is available, and that is the closest usable substitute. ## Troubleshooting - **Google Ads says the email does not match a Google Account**: do not keep retrying, and check the address is not mistyped only once. This is almost always a restriction on your Ads account rather than a typo. Look at `Access and security` → `Security` → `Allowed domains`: if that list is turned on, it blocks the service account's domain. Either add the domain, or [get in touch](https://rig.so/contact) and we will connect the account over OAuth instead. - **Permission denied, and the error mentions the manager account**: Google's message names `login-customer-id` whenever access fails, even when the real cause is that nobody has added the service account yet. Check the grant exists in `Access and security` before changing the manager ID. - **You pasted your own developer token and it fails**: Google permanently pairs each Cloud project with the first developer token it uses. A token of your own only works alongside OAuth client credentials from your own Cloud project, so on this path it fails with `DEVELOPER_TOKEN_PROHIBITED` even though your account access is perfectly correct. Leave the field blank. - **Numbers look low against the Ads UI**: check the date range first. Recent days move for about 30 days as conversions attribute retroactively. If you would rather authenticate with your own OAuth client than share in, Rig accepts a client ID, client secret and a refresh token minted with this scope: `https://www.googleapis.com/auth/adwords`Copy On that path you supply your own developer token as well, because it has to come from the same Cloud project as the OAuth client. Google refresh tokens do not rotate or expire in use, so it is a one-time setup, but the read-only user above is faster and easier to audit. ## What people use this for - Measure ROAS and cost per conversion across campaigns - Find wasted spend at the keyword and ad level - Track spend pacing against budget - Join ad spend to revenue for true blended performance [More ideas for using Google Ads](https://rig.so/integrations/google-ads) Was this guide helpful? Yes No --- - [This page as HTML](https://rig.so/guides/connect-google-ads) - [Site map for language models](https://rig.so/llms.txt) - [API and agent documentation](https://rig.so/developers)