Google is piloting a new security layer for the Google Ads API that locks down sensitive operations across manager account (MCC) hierarchies.
The core idea: only a pre-approved allowlist of Google Cloud projects can call sensitive API methods (account management, user management, and billing) on accounts under a protected manager account. Google audits the hierarchy’s API activity, builds the allowlist together with the developer, and from then on any unapproved application making those calls simply fails.
The main benefit is takeover protection: even if API credentials get compromised, an attacker’s app can’t perform sensitive actions because it isn’t on the allowlist. It also gives advertisers a clear overview of which applications actually have access to their accounts.
Worth knowing before joining: newly linked accounts inherit the protection (their existing apps may need to be allowlisted first), unlinked accounts lose it, and allowlist changes take up to 10 business days.
The pilot is open for sign-ups. Developers can apply via a form with the customer ID of the top-level manager account they want to secure.
See the blog post for more details: Google Ads API pilot: Secure API Access to your Manager Accounts.