How access is protected

How do I authorize without an API key?

You do not paste a credential anywhere. Authorization happens over OAuth 2.1 with PKCE, in your own browser:

1. Your assistant registers itself as a client and sends you to the AdvisorPPC authorization screen.
2. You authenticate and approve the connection explicitly. Approval requires a deliberate action, never just loading a page.
3. A short-lived authorization code is exchanged for a token bound to the exact endpoint you connected. A token minted for one AdvisorPPC endpoint is rejected by the others.
4. Nothing sensitive is stored in an assistant config file, so there is no secret to leak from a laptop, a synced settings file, or a shared screen.

Where do the Google tokens live?

On our servers, encrypted, and never handed to the assistant.

• You authorize Google on Google's own consent screen. AdvisorPPC never sees your Google password.
• Refresh tokens are encrypted at rest and scoped to your tenant. Every tool call resolves the caller's identity before any external call, so one account cannot read another's data.
• Tokens are used to call the official Google APIs and are never returned in a tool result, so they cannot end up in a chat transcript.

What stops an assistant from changing something?

The server, not the prompt. Write operations are plan-gated and quota-enforced before the provider API is touched.

• Plan gate. A client may list tools outside your current access. Calls still require the appropriate entitlement and Google permissions. Free permits Google Ads reads and does not permit writes.
• Quota gate. Free reserves allowance before each Google Ads API attempt and counts successful cached or local report reads separately. Workspace status, connection help, saved receipts and news are unmetered. See plans and limits for how pages and retries count.
• Review and confirmation. Follow each tool's documented confirmation requirements. Google Suite change plans bind the proposed parameters and selected Google connection, expire after one hour, and allow one apply attempt. Inspect an unknown outcome before retrying; a timeout does not establish that nothing changed.
• Server side, always. These checks run in our service. No instruction in a conversation, a document, or a web page can turn them off.

Official APIs only

Every call goes through the provider's documented API: the Google Ads API, the Google Analytics Data and Admin APIs, the Search Console API, the Tag Manager API, and the YouTube Data and Analytics APIs. There is no browser automation against your accounts and no screen scraping, so nothing depends on being logged in as you in a browser somewhere, and nothing breaks silently when a provider changes an interface.

How do I revoke access?

Three independent ways, any of which takes effect immediately:

• Remove the AdvisorPPC connector in your assistant's connector settings. That stops the client from calling at all.
• Revoke the connection from your AdvisorPPC dashboard.
• Remove AdvisorPPC from your Google account permissions. The stored tokens stop working regardless of anything on our side, which is the control that does not depend on trusting us.

Data deletion requests go to technical support at support@advisorppc.com, sent from your account email. The privacy policy and terms of service apply to every connection, and the support page lists which address handles what.