How an agency operates N Google Ads accounts with one MCC, 1 token and 1 OAuth — and why plugging in a new client is a single line.
MCC = the agency's manager account · 1 token + 1 OAuth operate any client · adding a client = 1 customer_id
An agency running Google Ads for many clients hits a silent mess: each client has their own account, their own login, their own permission. Multiply by ten and you have ten places to log into, ten tokens, ten points where something breaks.
And when you want to automate — pull reports, upload offline conversions, pause a campaign via API — each account would need its own access setup. It doesn't scale. Google solved this with a structure built for agencies: the MCC.
An MCC (Manager Account) is an account that sits ABOVE the client accounts. You link each client's Google Ads account to your MCC, the client accepts the invite, and that's it — you operate all of them from one place, without knowing anyone's password.
The client's account stays theirs: the money, the billing, the data. The MCC is just the agency's access and operation layer on top. It's the same model Google uses internally for large advertisers.
Here's the trick for automation. With the MCC, you authenticate ONCE — 1 developer token + 1 OAuth app (which yields 1 refresh_token) — and that credential operates any subaccount. To target a specific client, you pass their customer_id + the login_customer_id (the MCC). That's all.
→ Switching clients means switching a string. No new login, no new token, no new Google approval.
Because the authentication is a single one, onboarding a new client is almost no work:
Link the client's account under the MCC and have them accept the invite (once, in the Google Ads UI).
Write the customer_id (10 digits) into a config line.
Done. The scripts already operate the new account — reports, conversions, campaigns.
→ The existing clients never even know another one joined. Onboarding with no access renegotiation, no new app, no waiting for approval.
Our MCC operates client accounts via Node scripts using the official google-ads-api library. A shared layer reads the credentials once and builds the API client already pointing at the MCC's login_customer_id. Two capabilities come out of it:
In practice: opening a client's terminal and asking “how many active campaigns do they have” returns the answer instantly — the MCC credential already knows how to operate that account.
Centralizing has a cost: blast radius. If the refresh_token dies or the MCC gets suspended, it affects ALL clients at once — unlike an isolated model, where each client has its own credential and a problem stays contained.
It's the opposite of how we treat Meta: there, each client gets a dedicated App on purpose, because CTWA/leadgen requires isolation per WhatsApp Business. On Google, the MCC is the mechanism Google itself designed for agencies — so the gain of operating everything with one credential outweighs the risk, as long as it's monitored.
Use the structure the platform designed for your case. On Google, agency = MCC: one authentication, every account, plugging a client is one line. Just don't confuse it with per-client isolation — each platform has its own model.