Cannot use Test Developer Token to link or create clients under Test MCC

[alisson blaas]

Hi Google Ads API Team,

I’m building an integration using the REST API (v21) with a developer token approved for Test Access only.

My setup

• Account 1: account@.....

  • Has a developer token (ID: a7d3rvlyJBNO9haM1DVPnA)

  • Status: Test Access only

  • Can call customers:listAccessibleCustomers successfully

  • ⚠️ Does not show the red “Test account” label in the UI

• Account 2: ratoblaas6@....

  • Shows the red “Test account” label in the UI

  • ⚠️ API Center is disabled:
    “The API Center is not available for test accounts. Use the developer token from your production manager account (not a test account).”

  • So I cannot get a developer token here.

This leaves me in a situation where:

• One account has a Dev Token but no red label.

• The other has the red label but no Dev Token.
  
  

What works ✅

I can fetch accessible accounts with the test developer token:

export async function getAccessibleCustomerId(userAccessToken: string) {
  const res = await fetch(
    "https://googleads.googleapis.com/v21/customers:listAccessibleCustomers",
    {
      headers: {
        Authorization: `Bearer ${userAccessToken}`,
        "developer-token": process.env.GOOGLE_DEVELOPER_TOKEN!,
      },
    }
  );
  return await res.json();
}

This returns valid customer IDs (e.g. customers/1234567890).


What fails ❌

a. Sending MCC invitation (customerClientLinks:mutate)
export async function inviteClientFromMcc(clientCustomerId: string) {
  const MCC_ID = process.env.SANDBOX_MANAGER_ID!;
  const mccAccessToken = await getMccAccessToken();

  const res = await fetch(
    `https://googleads.googleapis.com/v21/customers/${MCC_ID}/customerClientLinks:mutate`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${mccAccessToken}`,
        "developer-token": process.env.GOOGLE_DEVELOPER_TOKEN!,
        "login-customer-id": MCC_ID,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        operation: {
          create: {
            clientCustomer: `customers/${clientCustomerId}`,
            status: "PENDING",
          },
        },
      }),
    }
  );

  return await res.json();
}

export async function inviteClientFromMcc(clientCustomerId: string) {
  const MCC_ID = process.env.SANDBOX_MANAGER_ID!;
  const mccAccessToken = await getMccAccessToken();

  const res = await fetch(
    `https://googleads.googleapis.com/v21/customers/${MCC_ID}/customerClientLinks:mutate`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${mccAccessToken}`,
        "developer-token": process.env.GOOGLE_DEVELOPER_TOKEN!,
        "login-customer-id": MCC_ID,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        operation: {
          create: {
            clientCustomer: `customers/${clientCustomerId}`,
            status: "PENDING",
          },
        },
      }),
    }
  );

  return await res.json();
}

Response:

{ "error": { "code": 403, "message": "The caller does not have permission", "status": "PERMISSION_DENIED", "details": [{ "errors": [{ "errorCode": { "authorizationError": "DEVELOPER_TOKEN_NOT_APPROVED" }, "message": "The developer token is only approved for use with test accounts." }] }] } }

b. Creating a client under MCC (createCustomerClient)
export async function createCustomerInMcc() {
  const MCC_ID = process.env.SANDBOX_MANAGER_ID!;
  const mccAccessToken = await getMccAccessToken();

  const res = await fetch(
    `https://googleads.googleapis.com/v21/customers/${MCC_ID}:createCustomerClient`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${mccAccessToken}`,
        "developer-token": process.env.GOOGLE_DEVELOPER_TOKEN!,
        "login-customer-id": MCC_ID,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        customerClient: {
          descriptiveName: `OneClickAds User ${Date.now()}`,
          currencyCode: "USD",
          timeZone: "America/New_York",
        },
      }),
    }
  );

  return await res.json();
}

Response: same 403 PERMISSION_DENIED with DEVELOPER_TOKEN_NOT_APPROVED.

My questions ❓

1. Is it expected that customerClientLinks:mutate and createCustomerClient cannot be used with a Test Developer Token?

   • The docs say:

     “With this token, you can make requests successfully, but only against test accounts.”
     But in practice, only listAccessibleCustomers works.

2. Should linking and creating clients also work in sandbox, or are these calls intentionally blocked until Basic Access is granted?

3. Since a true Test MCC (red label) cannot generate a developer token, while a Test developer token account does not show the red label, what is the correct way to test the “invite client to MCC” flow under test conditions?

[Google Ads API Forum Advisor]

Hi,

Thank you for reaching out to the Google Ads API support team.

Please be informed that it is expected that customerClientLinks:mutate and createCustomerClient cannot be used with a developer token that only has "Test Access" when targeting a non-test account. The key here is the distinction between "Test Access" on a developer token and an actual "Test account." The developer token is a prerequisite for any API calls. It's tied to your Google Ads Manager Account (MCC) and is granted by default when you first apply for API access. This token is only approved for use with test accounts. The test account is explicitly designed for testing and is separate from production accounts.

Account 1 (account@...): This is a production manager account. You can get a developer token here, but since it's a production account, your "Test Access" developer token is restricted. Account 2 (ratoblaas6@...) is a true test account (as indicated by the red label). The API Center is disabled for this account because Google requires that you use a developer token from a production manager account to interact with all accounts, including test accounts.​ ​ ​ ​ ​ ​ ​ ​

Also, the DEVELOPER_TOKEN_NOT_APPROVED error means the developer token is only approved for use with test accounts. To access non-test accounts, apply for Basic or Standard access. If your API access is still in the test, the presented issue is caused by making a call against a production account with a developer token only approved for test access. You can apply for Basic Access by following the steps outlined here.

Also, kindly create a new Google Ads Manager Account from scratch. This is your "Test MCC" and will have the red "Test account" label in the UI. Under this Test MCC, create one or more client accounts. These will be your "Test Client Accounts," also with the red label. I would recommend you refer to the guide Create test accounts and campaigns to get more information.

I hope this helps! Feel free to get back to us in case of any further queries.
 

Thanks,
 

Google Ads API Team

Feedback
How was our support today?

               
[2025-08-28 07:51:21Z GMT] This message is in relation to case "ref:!00D1U01174p.!500Ht01u5Gvw:ref" (ADR-00331096)