Hello,
You can create your credentials, such as your refresh token, from your MCC account. You will be able to make API calls with these credentials, but you will need to set your clientCustomerId to a client account level when you do. You won't be able to call services such as the CampaignService, since you will get no results if you call it from the MCC level. There are certain API services such as the ManagedCustomerService that you can call from the MCC level. You can find more details
here.
Regards,
Anthony
Google Ads API Team

ref:_00D1U1174p._5004Q22XT0C:ref