# Account scoping

> Which advertising accounts a tool can reach, and how that limit is enforced.

[Documentation](https://www.getmcpads.com/docs) / [Concepts](https://www.getmcpads.com/docs/concepts/discovery)

Connecting a platform rarely grants access to one account. A Google Ads manager account reaches every client under it, a Meta Business Manager reaches every ad account it administers, and one Google Analytics connection in testing reached fourteen properties.

So the connection is not the permission. In the dashboard you tick the accounts to expose, and that list is the boundary.

## Where the check happens

Server side, on every call, before the request reaches the platform. It cannot be influenced by the client, because an MCP client composes its own calls and can propose any identifier it likes.

The account parameter each source uses

| Source | Parameter |
| --- | --- |
| Meta Ads | `adAccountId` |
| Pinterest Ads | `adAccountId` |
| Google Ads | `customerId` |
| TikTok Ads | `advertiserId` |
| Search Console | `siteUrl` |
| Google Analytics 4 | `propertyId` |

The check does not stop at that parameter. Some tools are generic escape hatches that take a free-form body, and an account identifier can sit anywhere inside it. Every argument is walked, at any depth, and every account identifier found is checked against the allowlist.

Refused: the identifier is nested, and still checked

```json
{
  "name": "tiktok_get_read_endpoint",
  "args": {
    "endpoint": "campaign/get",
    "parameters": { "advertiser_id": "an advertiser you did not tick" }
  }
}
```

> **Note** A tool that names no account, such as a health check or a targeting dictionary, is allowed: it cannot read anything belonging to a specific advertiser.

## Tokens

- Refresh and access tokens are encrypted at rest with AES-256-GCM.
- No tool returns a token, and none is written to a log.
- No token reaches the browser.
- Revoking the connection in the dashboard, or at the platform, ends the access immediately.

---

This page as HTML: https://www.getmcpads.com/docs/concepts/accounts
Every page under /docs is available as Markdown: append `.md`, or send `Accept: text/markdown`.