Token scopes
Org-scoped vs project-scoped, read vs write — how a token decides what an MCP client can reach.
A token carries two independent dimensions: which accounts it can reach, and whether it can write. Mint tokens in the app; the secret is shown once.
Account scope
| Scope | Where to mint | Reach |
|---|---|---|
| Org-scoped | Workspace → Settings → MCP | Every account in the workspace. Account-scoped tools take an extra projectId — call gads_list_ad_accounts first to enumerate them. Can optionally be limited to a subset of accounts at creation. |
| Project-scoped | Account → Settings → MCP | One account. Omit projectId — it's already bound; a different one is refused. |
With an org token, targeting a projectId outside an allowed subset is refused, listings filter to the set,
and approvals check the action's account against it.
Read vs write
read and write are orthogonal to account scope. A read token can call every read tool; the money-moving
gads_propose_* and the approval tools require write. Calling a write tool with a read token returns an
error telling you to mint a write token.
Rate limits
Limits are per user, not per token: 60 reads/min and 10 writes/min. See Rate limits.
Treat a write org-scoped token like a key to every account's spend. Prefer the narrowest scope that does the
job — a project-scoped token, or an org token limited to a subset.