What ClickClickBlock does with your Google Ads account
Our integration with the Google Ads API has a single, narrowly-scoped purpose: add fraudulent IPs to your campaign or account-level exclusion list so those IPs stop seeing your ads. Below is an exhaustive list of what we do and, critically, what we do not.
CampaignCriterionService.Mutate, we append IPs flagged as fraud by our detection rules to your campaigns' IP exclusion lists. Your ad still runs — Google just stops showing it to those specific IP addresses.CustomerNegativeCriterionService.Mutate, we apply IP exclusions to the customer level so Performance Max campaigns are protected too.GoogleAdsService.SearchStream, to know which campaigns to attach IP exclusions to. No other data is pulled.The OAuth 2.0 consent flow
ClickClickBlock never stores, requests, or requires your Google Ads password. All access is obtained through Google's standard three-legged OAuth 2.0 flow using the narrow https://www.googleapis.com/auth/adwords scope. You initiate the flow from inside the ClickClickBlock dashboard — nothing happens until you click Connect.
You click "Connect Google Ads" in the dashboard
From the Account tab. No credentials are entered in our interface.
Your browser is redirected to accounts.google.com
Using our Google Cloud OAuth client_id, the adwords scope, and access_type=offline. The request is signed with a short-lived JWT carrying your tenant ID so the callback can prove authenticity.
You sign in with your own Google identity and review the consent screen
Google displays the consent screen showing ClickClickBlock wants to "manage your AdWords campaigns" — which is Google's own wording for the adwords scope. You can decline at any time.
On approval, Google redirects back to /oauth/google/callback
With a short-lived authorization code. Our server validates the signed JWT state parameter to prevent CSRF.
We exchange the code for access + refresh tokens
Via oauth2.googleapis.com/token. The access token is kept only in memory for the duration of the sync cycle and never persisted.
The refresh token is encrypted and stored
Encrypted with AES-256-GCM using a per-instance master key held in our environment configuration (never in source code). Written to your tenant's row in our database.
We call ListAccessibleCustomers once
To confirm which customer_id the consenting user has access to, so we know which account to target for IP exclusion writes.
Your dashboard now shows "Google Ads: Connected"
Fraudulent IPs will sync to your Google Ads account every 2 minutes from this point forward.
Exact API methods we call
These are the only Google Ads API services ClickClickBlock ever calls. Every call is scoped to the authenticating customer's own customer_id.
| Service / method | Type | Purpose |
|---|---|---|
GoogleAdsService.SearchStream | Read | List your enabled campaigns and their IDs, so we know where to attach negative IP criteria. |
CustomerService.ListAccessibleCustomers | Read | One-time call after OAuth to confirm which customer_id the user can act on. |
CampaignCriterionService.Mutate | Write | Add or remove IP_BLOCK negative criteria on specific campaigns (Search, Display, Shopping, Video). |
CustomerNegativeCriterionService.Mutate | Write | Add or remove IP_BLOCK negative criteria at the customer (account) level to cover Performance Max. |
Not used
We never call: KeywordPlanService, RecommendationService, ConversionActionService, CustomerClientService (beyond list-accessible), BatchJobService, ReachPlanService, AudienceService, or any reporting beyond campaign name/status lookup.
Disconnecting your Google Ads account
Three ways to disconnect, depending on which side you prefer to drive from:
From within ClickClickBlock
- Account tab → "Disconnect Google Ads" button
- We call
oauth2.googleapis.com/revokewith the refresh token to immediately invalidate it on Google's side - We delete the encrypted refresh token from our database
- Your IP exclusion lists are left as they were (we do not remove previously-synced IPs on disconnect, but you can remove them via the Google Ads UI if you wish)
From your Google Account security page
- Go to myaccount.google.com/permissions
- Find ClickClickBlock and click "Remove access"
- Our next API call will fail with
invalid_grant, at which point we automatically delete the stored token and email you to reconnect if you wish
On subscription cancellation
If you cancel your ClickClickBlock subscription, your stored Google Ads refresh token is revoked and deleted within 24 hours.
Data handling & security
What we store
- Your encrypted Google Ads refresh token (AES-256-GCM, per-instance master key)
- Your Google Ads
customer_id(needed to target API calls) - Your
login_customer_idif using an MCC (optional) - The timestamp of connection / disconnection
- A log of which IP exclusions we've pushed, for audit purposes (IP address + timestamp + mutation response ID)
What we do NOT store
- Google Ads access tokens (in-memory only, never persisted, re-minted as needed)
- Campaign data beyond name and ID
- Bid amounts, budgets, conversion data, or audience lists
- Any personally-identifiable Google account information beyond the account email you used to sign up for ClickClickBlock
Infrastructure
- Hosted on Render (US region) with managed HTTPS and filesystem-level encryption at rest
- Database: SQLite on a persistent disk with Render-managed snapshots retained 7 days
- Source code: private GitHub repository; deploys require pushes to a protected
mainbranch - No third-party sub-processors receive Google Ads data. Stripe sees only billing identifiers; Resend sees only transactional email content
Compliance commitments
- We comply with the Google Ads API Terms & Conditions and the Google API Services User Data Policy, including Limited Use requirements.
- We use the developer token only for the purpose described on this page — click-fraud protection via IP exclusion management — and never transfer, sell, or share it.
- Data retrieved via the Google Ads API is never used for advertising, resold, used for machine-learning training beyond the scope described, or disclosed to any third party.
- We will notify affected customers and, where required, Google within 72 hours of any security incident involving Google Ads API credentials.
- Primary technical contact for API compliance matters: [email protected]
Ready to protect your Google Ads campaigns?
14-day free trial, no credit card. Install the snippet, connect Google Ads, done.
Start free trial →