Ad account management
Why this matters for your business
Connecting an ad account sounds trivial, but it's where most multi-platform tools break. Tokens expire silently. Permissions get revoked when an admin leaves. Multiple ad accounts under one Manager get confused with each other. The "why didn't this campaign launch?" investigation often ends with "oh, our token expired three weeks ago" — three weeks of missing data and broken automation.
Ad account management on this platform is built to stay connected. OAuth tokens auto-refresh; expirations are caught days before they happen, not after. Multi-account hierarchies (MCC for Google, Business Manager for Meta) are first-class. Permissions are scoped narrowly so you give exactly what's needed and nothing more. The result: connect once, forget about it, focus on results.
What this typically unlocks
| Outcome | Result |
|---|---|
| Time to connect 3 platforms | ~20 minutes total |
| Token-expiration outages | near 0 — auto-refresh + early warnings |
| Permission audit complexity | simple — narrow scopes documented |
| Multi-account / MCC support | built-in |
| Credential security | encrypted at rest, never logged |
What you actually get
| Capability | Description |
|---|---|
| OAuth connection | One-click for Google / Meta / TikTok |
| Multi-account hierarchies | Google MCC, Meta Business Manager, TikTok Business Center |
| Auto-refresh | Long-lived tokens refreshed proactively |
| Expiration warnings | 14-day and 3-day reminders if a token will expire |
| Permission scoping | Narrowest scopes that work; documented per platform |
| Credential encryption | At-rest AES-256, in-transit TLS 1.3 |
| Disconnect / reconnect | One click; no data loss |
| Audit log | Every credential change logged |
How connection works
Google Ads
- Click Connect Google Ads in admin
- Sign in with your Google account (must have access to the target Google Ads account or MCC)
- Approve scopes:
adwords(read campaigns + create) +analytics.readonly(Conversion API) - If you have an MCC: pick which sub-accounts to manage
- Done — typically 90 seconds
Meta Ads
- Click Connect Meta Ads
- Sign in with your Facebook account that has Business Manager access
- Approve scopes:
ads_management,business_management,pages_read_engagement(for organic insights) - Pick the ad accounts (within your Business Manager) you want to manage
- Pick Pixel(s) to link
- Done — typically 2-3 minutes
TikTok Ads
- Click Connect TikTok Ads
- Sign in with your TikTok For Business account
- Approve scopes:
ad.read,ad.write,event.read - Pick the advertiser accounts (within your Business Center)
- Done — typically 2 minutes
How auto-refresh works
Most refresh failures are silent admin-side issues (admin user removed from Business Manager, etc.). The 14-day window gives you time to fix without disruption.
Real merchant scenarios
Scenario A — Mid-market brand connects in 18 minutes
Setup. Brand running ads on all 3 platforms. Connecting for the first time.
Timeline.
- 09:00 — Click Connect Google Ads, OAuth, MCC sub-account selected
- 09:03 — Click Connect Meta Ads, OAuth, BM accounts + Pixel selected
- 09:10 — Click Connect TikTok Ads, OAuth, advertiser accounts selected
- 09:18 — All three platforms showing live spend data in dashboard
Result. 18 minutes from "I want to connect" to "I see my ad performance from all 3 platforms in one chart."
Scenario B — Agency manages 12 brands' ad accounts
Setup. Agency manages 36 ad accounts (12 brands × 3 platforms).
Approach. Each brand's connection happens through the brand's own OAuth (the agency doesn't see credentials — permissions delegate via Business Manager / MCC).
Operational benefit. When an agency staff member leaves, their access is revoked at the platform level (Google / Meta / TikTok); orchestration's token continues to work because it's scoped to the agency's master service account, not the individual.
Scenario C — Token expires at 3 AM, but didn't break anything
Setup. Brand's Meta token had an unusual edge case — primary admin account had MFA reset. Token would have expired in 14 days.
What happened:
- Day -14: Auto-refresh detected token wouldn't auto-renew. Email
- in-app alert sent.
- Day -3: Second alert (still no action).
- Day -1: P1 anomaly fired in admin (visible to whole team).
- Day 0: Brand's marketing lead saw the alert, re-OAuthed in 4 minutes.
Result. No campaigns paused, no data lost. Without the 14-day warning, the brand would have discovered the issue when ROAS reports went blank.
Best practices
✅ Connect via a service account / shared OAuth when possible. Personal accounts break when people leave.
✅ Use MCC / Business Manager / Business Center to scope permissions narrowly. Direct ad-account OAuth gives broader permissions than needed.
✅ Respond to 14-day warnings same week. Don't wait for the 3-day or 24-hour escalation.
✅ Keep at least 2 admins per ad account. Single-admin setups are fragile.
❌ Don't share OAuth credentials between team members. Use platform-level access instead.
❌ Don't disconnect a platform "to clean up." It pauses in-flight campaigns and loses historical metric continuity.
Plan tiers
| Capability | Free | Starter | Pro | Agency | Enterprise |
|---|---|---|---|---|---|
| Google Ads connect | — | — | ✓ | ✓ | ✓ |
| Meta Ads connect | — | — | ✓ | ✓ | ✓ |
| TikTok Ads connect | — | — | ✓ | ✓ | ✓ |
| Multi-account / MCC | — | — | ✓ | ✓ | ✓ |
| Auto token refresh | — | — | ✓ | ✓ | ✓ |
| Multi-brand connection | — | — | — | ✓ | ✓ |
| SSO-linked admin | — | — | — | — | ✓ |