> [!NOTE]
> **Note:** The Google Ads API client libraries automatically handle the details covered in this guide. Read this guide if you want to understand what happens behind the scenes or if you aren't using a client library.

This section is intended for advanced users who are already familiar with the
[OAuth 2.0 specification](https://datatracker.ietf.org/doc/html/rfc6749) and know how to [use OAuth 2.0 with Google
APIs](https://developers.google.com/identity/protocols/oauth2).

## Scope

A single access token can grant varying degrees of access to multiple APIs. A
variable parameter called `scope` controls the set of resources and operations
that an access token permits. During the access token request, your app sends
one or more values in the `scope` parameter.

The scope for the Google Ads API is:

    https://www.googleapis.com/auth/adwords

## Offline access and token lifetimes

It's common for a Google Ads API client app to request offline access. For example,
your app may want to run batch jobs when your user is not physically online
browsing your website. Access tokens have a lifetime of 3,600 seconds (1 hour),
after which your app must exchange a refresh token for a new access token.

To request offline access for a web app type, make sure you set the
`access_type` parameter to `offline`. You can find additional information in
[Google's OAuth 2.0 guide](https://developers.google.com/identity/protocols/oauth2/web-server#offline).

For the desktop app type, offline access is enabled by default---you don't
have to explicitly request it.

## Request headers

All requests to the Google Ads API must include the OAuth 2.0 access token in the
request header. The following sections describe how to pass these credentials
using gRPC and REST.

### gRPC headers

When using the gRPC API, include the access token in each request. You can bind
a `Credential` to a `Channel` for use on all requests on that channel. You can
also send a customized credential for each call. The [gRPC Authorization
guide](https://grpc.io/docs/guides/auth.html) contains more details on handling authorization.

### REST headers

When using the REST API, pass the access token through the HTTP header
`Authorization: Bearer <ACCESS_TOKEN>`. An example HTTP request is shown:

    # Returns the resource names of customers directly accessible by the user
    # authenticating the call.
    #
    # Variables:
    #   API_VERSION,
    #   OAUTH2_ACCESS_TOKEN:
    #     See https://developers.google.com/google-ads/api/rest/auth#request_headers
    #     for details.
    #
    curl -f --request GET \
    "https://googleads.googleapis.com/v${API_VERSION}/customers:listAccessibleCustomers" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer ${OAUTH2_ACCESS_TOKEN}" \