The following table summarizes the credentials an app must manage. For more
information about app types, see the [Google Identity OAuth 2.0
documentation](https://developers.google.com/identity/protocols/oauth2).

| Authentication workflow | Credential | Type of credential | Purpose |
|---|---|---|---|
| JavaScript web apps Android apps | OAuth client ID | App credentials | Uniquely identifies the app during an OAuth flow. |
| JavaScript web apps Android apps | Access token \& refresh token | User credentials | Represents the user's authorization to let the app access their Google Ads account on their behalf. |
| Server-side web apps Desktop and iOS apps TV and Device apps | OAuth client ID \& client secret | App credentials | Uniquely identifies the app during an OAuth flow. |
| Server-side web apps Desktop and iOS apps TV and Device apps | Access token \& refresh token | User credentials | Represents the user's authorization to let the app access their Google Ads account on their behalf. |
| Service accounts | OAuth service account key | App credentials | Used for signing the OAuth request. |
| Service accounts | Service account's access token | User credentials | Represents the service account's authorization when a user shares their Google Ads account with the service account. |

> [!NOTE]
> **Note:** Service accounts require explicit [account access
> configuration](https://developers.google.com/google-ads/api/docs/oauth/service-accounts) to work with the Google Ads API.

There are several points to consider when managing credentials for a Google Ads API
app.

## Handle app credentials securely

App credentials refer to settings that are specific to your app and don't vary
from one user to another. Treat your OAuth app credentials with extreme care, as
they allow anyone who has them to use your app's identity to gain access to user
information. Store your OAuth app credentials in a secure place and protect
them, just as you would a password. Where possible, use a secrets manager, such
as [Google Cloud Secret Manager](https://cloud.google.com/secret-manager/docs/overview), to store app credentials. You
must never commit client credentials into publicly available code repositories.
We highly recommend that you avoid committing them to any code repository.

## Handle user credentials securely

User credentials refer to OAuth tokens that represent the user's authorization.
They are entrusted to you by users who give you permission to act and access
data on their behalf---either directly by authenticating your app, or
indirectly by sharing their Google Ads account with your service account. Never
transmit tokens in plaintext, and always store encrypted tokens at rest to
provide an extra layer of protection in the event of a data breach. Revoke
tokens or service account permissions when you no longer need access to a user's
account. After the tokens are revoked, delete them permanently from your
application or system.

## Handle refresh token revocation and expiration

If you use a user authentication flow, keep in mind that refresh tokens can be
invalidated at any time. For example, if you use a multi-user authentication
flow, the user could choose to revoke access to your app. While an app that uses
a single-user authentication flow is less likely to be affected this way, a
manual or automated process designed to protect users could still purge the
refresh token, or the refresh token could expire. If your app requires
notification of token revocation to provide a good experience for users, you
must integrate with the [Cross-Account Protection](https://developers.google.com/identity/protocols/risc) service.

## Reuse user credentials across your API requests

OAuth access tokens are short-lived and expire after one hour. If you use a
Google Ads API client library, the library handles access token expiration and
refreshes in a thread-safe manner. Construct a Google Ads API client object with the
appropriate OAuth credentials and reuse it throughout its lifetime.

If you build your own access token refresh and management strategy, track the
access token expiration and reuse tokens while they remain valid. When you
request a token refresh, the authorization server returns a new access token
along with the [remaining lifetime in seconds](https://developers.google.com/identity/protocols/oauth2/web-server#exchange-authorization-code)
(`expires_in`). We recommend proactively refreshing the access token if there
are fewer than 5 minutes remaining before expiration.