When working with the Google Ads API, email addresses are used in multiple places for
contact and access management. The most important of these are:

- **Google Ads API contact email** : The email addresses assigned the **Owner** or **Editor** role on your Google Cloud project, which Google uses to send Mandatory Service Announcements (MSAs) and administrative notifications.
- **Google Cloud Console account email**: The email that holds administrator access to the Google Cloud project used for your OAuth 2.0 application.
- **Google Ads manager account access** : The [service account](https://developers.google.com/google-ads/api/docs/oauth/service-accounts) (recommended) or shared email alias that holds access permissions on the Google Ads manager account(s) accessed through the Google Ads API.

> [!NOTE]
> **Note:** We strongly recommend using service accounts or shared team aliases rather than individual user emails so that you don't lose access to these accounts when team members switch teams or leave the company. Ensure that any shared email alias used for Google Cloud or Google Ads authentication is backed by an active Google Account capable of receiving emails and completing [passkey verification](https://developers.google.com/google-ads/api/docs/oauth/security-requirements#passkey-requirements).

The rest of this guide elaborates on each of the accounts listed earlier and how
you can configure them so your integration doesn't depend on an individual
user's email address.

## Google Ads API contact email

Google sends administrative notifications, API review updates, audit requests,
Mandatory Service Announcements (MSAs), and production emergency communications
to the email addresses associated with the **Owner** and **Editor** roles of
your Google Cloud project (see [New API contact emails](https://developers.google.com/google-ads/api/docs/api-policy/developer-token#new-api-contact-emails),
as the legacy API Center contact email setting in the Google Ads UI has been
sunset).

To update your contact email and ensure that your whole team receives these
notifications, grant the **Owner** or **Editor** role to a shared team alias in
your [Google Cloud project](https://developers.google.com/google-ads/api/docs/productionize/shared-aliases#cloud_console) and monitor emails sent to that
alias regularly.

## Google Cloud Console account

The Google Cloud Console project contains your application's OAuth credentials
and controls access to the Google Ads API. Ensure access to this project by granting a
shared team alias the **Owner** (or **Editor**) role.

Follow these steps to add a shared alias as a Google Cloud project owner:

1. Sign in to the [Google Cloud Console](https://console.cloud.google.com).
2. Select your project from the project selector at the top of the page.
3. In the navigation menu, go to **IAM \& Admin \> IAM**.
4. Click **Grant Access**.
5. In the **Add principals** section, enter the shared email address in the **New principals** field.
6. In the **Assign roles** section, click **Select a role** , and select **Basic \> Owner** (or **Basic \> Editor**).
7. Click **Save** . If you granted the **Owner** role to an email address outside your Google Cloud organization (or on a project without an organization), Google Cloud sends an invitation email to the shared alias that must be accepted before the role takes effect. Refer to the Cloud documentation to learn more about [granting and revoking access](https://cloud.google.com/iam/docs/granting-changing-revoking-access#single-role).

## Google Ads manager account

A common method of managing accounts using the Google Ads API is to link all your
accounts under a common manager account, and make API calls to all the accounts
using the top-most manager account's credentials. In this configuration, the
developer sets the [`login-customer-id`](https://developers.google.com/google-ads/api/docs/oauth/access-model#login-customer-id) request header
(or `login_customer_id` client library configuration setting) to the 10-digit
customer ID (without hyphens) of the Google Ads manager account, and sets the target
`customer_id` to the operating account to which API calls are made.

### Recommended: Use a service account

Using a [service account](https://developers.google.com/google-ads/api/docs/oauth/service-accounts) is the preferred approach for
authenticating and accessing a Google Ads manager account. Unlike individual user
accounts, a service account is managed within your Google Cloud project and is
not tied to a specific person, preventing outages when team members change roles
or leave the company. Follow the [service account guide](https://developers.google.com/google-ads/api/docs/oauth/service-accounts) to
create a service account and grant it access to your Google Ads manager account.

### Alternative: Use a shared email alias

If your integration cannot use a service account and instead relies on the
[single-user authentication workflow](https://developers.google.com/google-ads/api/docs/oauth/single-user-authentication), a user with access to
the Google Ads manager account issues an OAuth 2.0 refresh token.

> [!CAUTION]
> **Caution:** If the authorized user loses access to the Google Ads manager account, the refresh token is no longer valid and all API calls fail immediately.

To avoid this scenario when using user credentials:

1. Invite a shared email alias (backed by an active Google Account with [passkey verification](https://developers.google.com/google-ads/api/docs/oauth/security-requirements#passkey-requirements) enabled) to manage this Google Ads manager account with the [appropriate access levels](https://support.google.com/google-ads/answer/9978556).
2. Accept the invitation using the shared email alias.
3. Use this shared email alias to issue the OAuth refresh token for making API calls.