How access is protected

How do I authorize without an API key?

You do not paste a credential anywhere. Authorization happens over OAuth 2.1 with PKCE, in your own browser:

1. Your assistant registers itself as a client and sends you to the AdvisorPPC authorization screen.
2. You authenticate and approve the connection explicitly. Approval requires a deliberate action, never just loading a page.
3. A short-lived authorization code is exchanged for a token bound to the exact endpoint you connected. A token minted for one AdvisorPPC endpoint is rejected by the others.
4. Nothing sensitive is stored in an assistant config file, so there is no secret to leak from a laptop, a synced settings file, or a shared screen.

Where do the Google tokens live?

On our servers, encrypted, and never handed to the assistant.

• You authorize Google on Google's own consent screen. AdvisorPPC never sees your Google password.
• Refresh tokens are encrypted at rest and scoped to your tenant. Every tool call resolves the caller's identity before any external call, so one account cannot read another's data.
• Tokens are used to call the official Google APIs and are never returned in a tool result, so they cannot end up in a chat transcript.

What stops an assistant from changing something?

The server, not the prompt. Write operations are plan-gated and quota-enforced before the provider API is touched.

• Plan gate. If your plan does not include write access, write tools are not advertised and a direct call is refused.
• Quota gate. Every call is counted and checked against your monthly allowance first. A denial happens before anything is sent, never halfway through.
• Confirmation on risky changes. Higher risk operations preview what they would do and apply only when you confirm.
• Server side, always. These checks run in our service. No instruction in a conversation, a document, or a web page can turn them off.

Official APIs only

Every call goes through the provider's documented API: the Google Ads API, the Google Analytics Data and Admin APIs, the Search Console API, the Tag Manager API, and the YouTube Data and Analytics APIs. There is no browser automation against your accounts and no screen scraping, so nothing depends on being logged in as you in a browser somewhere, and nothing breaks silently when a provider changes an interface.

How do I revoke access?

Three independent ways, any of which takes effect immediately:

• Remove the AdvisorPPC connector in your assistant's connector settings. That stops the client from calling at all.
• Revoke the connection from your AdvisorPPC dashboard.
• Remove AdvisorPPC from your Google account permissions. The stored tokens stop working regardless of anything on our side, which is the control that does not depend on trusting us.

Data deletion requests go to technical support at support@advisorppc.com, sent from your account email. The privacy policy and terms of service apply to every connection, and the support page lists which address handles what.