- Google sunset developer tokens on September 9, 2026. Access levels now belong to Google Cloud projects. [1][2]
- Each token’s level went to every project that used it in the previous 90 days. [2]
- A token unused for 90 days lost its access, and its project defaults to test accounts only. [2]
- The header is optional and ignored today. A future major version will reject it. [1]
- New Basic and Standard applications need brand verification. Basic is now reviewed within minutes. [1]
- v22 requests start failing on October 7, 2026. [3]
For most of the Google Ads API’s life, access was a string: a 22-character developer token, approved once, pasted into a config file, and forgotten. On September 9, 2026, Google sunset it. [2] Your access level now belongs to the Google Cloud project you used to generate your OAuth credentials, and you can keep sending the token in the header, but the servers ignore it. [1]
Google moved everyone across automatically, and for most live integrations nothing visible happened. The risk sits in the rule it used to decide who got what. It looked at the last 90 days of API calls, found the Cloud projects each token had been used with, and gave them the token’s level. [2] Anything that did not show up in those 90 days did not come along.
Who lost access in the move
Google’s own worked example makes the edge cases explicit. [2] A token used with three projects gave all three its Standard access. A token that was recently approved but had never made a call transferred to no project at all. A token with Standard access that had not been used for 90 days had its access revoked, and the project it once ran with now sits at Test access. A brand-new project with no history also starts at Test.
That describes a familiar list of marketing integrations. The quarterly budget script. The annual reporting job. The connector somebody set up for a client who paused spending in June. The internal tool that uses a different Cloud project from the one the token was usually paired with. Each of them looked fine on September 8, and each can now fail on its next run with an authorization error nobody has seen before.
What each access level can touch
The level decides two things: whether a project can reach accounts that serve real ads, and how many operations it may run in a sliding 24 hours. [4]
| Access level | Accounts it can call | Daily operations | Worth knowing |
|---|---|---|---|
| Test | Test accounts only | 15,000 | The default for a new or orphaned project [2][4] |
| Explorer | Test and production | 2,880 on production, 15,000 on test | No keyword planning, account creation, user management, or billing services [4] |
| Basic | Test and production | 15,000 | New applications need brand verification, then review within minutes [1][4] |
| Standard | Test and production | Unlimited | Google lists 10 business days for review [4] |
The Explorer row is the one that catches marketing teams. The restricted list includes KeywordPlanIdeaService, the service behind every keyword research script that pulls search volume, so a project stuck at Explorer can read and change campaigns but cannot size a keyword. [4] If a project in Test access tries to call a production account, v25 returns CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION, and older versions return ACTION_NOT_PERMITTED. [1][5]
The check, in order
None of this takes long if you do it before something fails. Google’s own action list and its sunset notice cover it in five steps. [1][3]
List the projects behind your credentials
For every script, connector, MCP server, and workflow that calls the API, find the OAuth client it uses and the Cloud project that client belongs to. That project, not the token in the config, now holds the access. [1]
InventoryCompare the levels
Read the token’s old level in the manager account’s API Center, then the project’s level on the Google Ads API Overview page in Cloud Console. If they differ, reapply from the Overview page or contact API support. [1]
AccessFind anything still on v22
In Cloud Console, open APIs and Services, then Google Ads API, then Metrics. Method names carry the version. Anything with v22 in it fails from October 7, 2026. The current release is v25.2. [3][6]
DeadlineFix who gets the notices
Google now sends its mandatory service announcements to the owners and editors on the project’s IAM page. If those are former staff or an agency you left, nobody will hear about the next change. [1]
GovernanceTake the token out
Google has published client libraries that work without a developer token and says a future major version will reject it. Remove the header now, while removing it is harmless. [1]
CodeFor step five, the change is smaller than it sounds. This request, with only an OAuth bearer token and no developer token header, returned our accessible customer list on September 25, 2026 on both v25 and v22:
curl -s "https://googleads.googleapis.com/v25/customers:listAccessibleCustomers" \ -H "Authorization: Bearer $ACCESS_TOKEN"
If you run Google Ads from an MCP server or a terminal, the same applies to the environment variable most setups still ask for. It can stay for now. It no longer decides anything.
Where you stand
Will your Google Ads API integrations survive October?
Tick what is true today. The first two decide whether anything runs at all after October 7, so the verdict cannot read Ready without them.
Weights follow what fails first. A v22 call and a project at the wrong level both stop an integration outright. The rest decide whether you hear about the next change before it breaks something.
There is some good news in the change too. You can now sign up for the API in Google Cloud Console without a manager account, and a Basic application that has completed brand verification is reviewed within minutes instead of days. [1] Existing access holders do not have to verify their brand, though Google encourages it. [1] The one exception to the new model is the App Conversion Tracking API, which still issues developer tokens from the API Center. [2]
Sources
- Google Ads Developer Blog · A new onboarding experience for Google Ads API developersSeptember 10, 2026. Access levels on Cloud projects, the ignored header, the new v25 error, brand verification, automated Basic review, and the action list.
- Google Ads API · Developer tokenThe September 9, 2026 sunset, the 90-day rule, the worked example, and the App Conversion Tracking exception.
- Google Ads Developer Blog · Google Ads API v22 sunset reminderSeptember 2, 2026. v22 requests fail from October 7, 2026, and how to find them in Cloud Console.
- Google Ads API · Access levels and permissible useWhat Test, Explorer, Basic, and Standard can call, their daily operation limits, the Explorer restrictions, and review times.
- Google Ads API · AuthorizationError (v25)The error reference, including CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION.
- Google Ads Developer Blog · Announcing v25.2 of the Google Ads APISeptember 23, 2026. The current release to migrate to.
Frequently asked questions
Are Google Ads API developer tokens gone?
As a way to control access, yes. Google says it sunset developer tokens on September 9, 2026. You can still send one in the request header, but it is optional and ignored by the API servers, and your access level is now determined by the Google Cloud project you used to generate your OAuth credentials.
How did Google decide which project got my access level?
Google examined the API call logs for the last 90 days to find the Cloud projects used with each approved developer token and gave all of them the token’s access level. A token that was never used transferred to no project, and a token unused for 90 days had its access revoked, leaving its project at Test access.
What can a project with Test access do?
Only call test accounts, which do not serve ads, up to 15,000 operations a day. To touch production accounts a project needs Explorer, Basic, or Standard access.
What is Explorer access?
An access level that can call production accounts, up to 2,880 operations a day against them, with some features restricted. Google lists keyword planning services, including KeywordPlanIdeaService, account creation, user management, and billing among the restrictions, so a keyword research tool needs Basic or Standard.
Will my code break?
Not because of the header. Google says existing code keeps working because the developer token is ignored, and a request with no developer token header returned normally when we tested it on September 25, 2026. It will break if the Cloud project behind your OAuth credentials has the wrong access level, if you still call v22 after October 7, 2026, or in a future major version that Google says will reject developer tokens.
What error will I see if the project’s level is too low?
In v25, a project with Test access calling a production account gets CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION. Older versions return ACTION_NOT_PERMITTED. Google’s fix is to apply for Explorer access from the Google Ads API Overview page of that project.
How do I find out if anything still calls v22?
Google’s sunset notice points to the Google Cloud Console: open APIs and Services, click Google Ads API, and look at the Metrics tab, where each method name includes the version, such as google.ads.googleads.v22.services.GoogleAdsService.Mutate.
Do I still need a manager account to get API access?
No. You can now sign up for the Google Ads API in the Google Cloud Console without a Google Ads manager account. The API Center in manager accounts remains for reference and will be sunset later. The App Conversion Tracking API is the exception that still uses developer tokens from the API Center.
Mikołaj Salecki
Writes about media, tech, and AI business for people who actually run digital. Former agency lead. Skeptic of frameworks that read better than they perform.
