Rotate AdWords API Developer Token

[Xiaochuan Zhou]

Hi AdWords guru,

What will be the risk if AdWords API Developer Token got leaked?

Reading through https://groups.google.com/forum/#!topic/adwords-api/mC7mB-YYH-Q, looks like developer token is mainly for "It's main purpose is to ensure that the developer has accepted AdWords API T&Cs, identify your requests in case we need to troubleshoot issues you are facing", it looks like it's pretty harmless?

If it is indeed risky, is it possible to rotate AdWords API Developer Token? Any consequence to the existing OAuth access token?

Please pardon me for the stupid question here. Thanks!

Joe

[Google Ads API Forum Advisor]

Hi Xiaochuan,

Thank you for reaching out to us.

What will be the risk if AdWords API Developer Token got leaked?

• Kindly note that developer token values are sensitive and should never be asked for since an issued developer token is a unique combination of letters, numbers, and characters that is required for communicating with the Google Ads API server. It authorizes your Google Ads API activity and thus you should treat it like a password.

If it is indeed risky, is it possible to rotate AdWords API Developer Token? Any consequence to the existing OAuth access token?

• You should reset your developer token if you believe that it's been compromised, or if a team member who has knowledge of the token has left. That being said, I would suggest you just reset your developer token, you may check this documentation for more details. Note that a reset will immediately invalidate your previous token, so any API requests using the old token will fail. However, a reset will not trigger a re-review and approval for the new developer token. You can start using the new developer token immediately.

Best regards,

Heidi Google Ads API Team

ref:_00D1U1174p._5004Q2ghidE:ref

[Xiaochuan Zhou]

Thank you so much Heidi for the response!

Just want to confirm before I go ahead to reset the developer token, will reset developer token affect the existing access token? Does users already authorized via OAuth needs to redo it again after the developer token reset?

Thanks!

Xiaochuan

[Google Ads API Forum Advisor]

Hi Xiaochuan,

I work with heidi. Thanks for reaching out to the Google Ads API Support.

Note that a reset will immediately invalidate your previous token, so any API requests using the old developer token will fail. However, this will not affect the existing access token, and you don’t need to be authorized via OAuth.

Regards,

Yasar Google Ads API Team

ref:_00D1U1174p._5004Q2ghidE:ref