# OAuth scopes

> What Get MCP Ads asks each advertising platform for, and what each request allows.
> Machine readable version: https://www.getmcpads.com/.well-known/oauth-scopes

A scope is what the platform grants. It is not what this gateway does with it.
Where a platform publishes no read-only scope, the read-only restriction is
enforced here instead: on the Free plan no write tool is announced, and calling
one is refused before it reaches the platform.

### Meta Ads

Provider: `meta`

- `ads_read`: Read Meta campaigns, insights, creatives and audiences.
- `ads_management` **(write)**: Pause, resume and change budgets on Meta campaigns, ad sets and ads. Only reachable on a paid plan.

What this gateway actually does: Write tools are hidden and refused on the Free plan. Every write previews by default and needs an explicit confirm. Campaign creation is always PAUSED.

### Pinterest Ads

Provider: `pinterest`

- `ads:read`: Read Pinterest campaigns, ad groups, ads and analytics.
- `ads:write` **(write)**: Pause, resume and change budgets on Pinterest campaigns. Only reachable on a paid plan.

What this gateway actually does: Write tools are hidden and refused on the Free plan. Every write previews by default and needs an explicit confirm. Campaign creation is always PAUSED.

### Google Ads

Provider: `google`

- `https://www.googleapis.com/auth/adwords` **(write)**: Read and write on Google Ads. Google publishes no read-only alternative, so read-only enforcement is done by this gateway, not by Google.

What this gateway actually does: Write tools are hidden and refused on the Free plan. Every write previews by default and needs an explicit confirm. Campaign creation is always PAUSED.

### TikTok Ads

Provider: `tiktok`

_No scope is passed through the authorization URL._

TikTok does not pass permissions through the authorization URL. They are attached to the app in TikTok Business Center and shown to the advertiser when access is granted.

What this gateway actually does: Write tools are hidden and refused on the Free plan. Every write previews by default and needs an explicit confirm. Campaign creation is always PAUSED.

### Search Console

Provider: `google`

- `https://www.googleapis.com/auth/webmasters.readonly`: Read Search Console performance, index coverage and sitemaps. Cannot modify anything.

What this gateway actually does: Read only. This gateway exposes no write tool for this platform.

### Google Analytics 4

Provider: `google`

- `https://www.googleapis.com/auth/analytics.readonly`: Read GA4 reports, metadata and property configuration. Cannot modify anything.

What this gateway actually does: Read only. This gateway exposes no write tool for this platform.

## Two limits that apply to every platform

**Accounts.** A connection often exposes far more than one ad account. One test
Google Analytics connection reached fourteen properties. Nothing is reachable
until the account owner ticks it in the dashboard, and the allowlist is checked
server side on every call, including calls routed through `run_tool`.

**Tokens.** Refresh and access tokens are encrypted at rest with AES-256-GCM.
They are never returned by a tool, never written to a log, and never sent to the
browser.

Contact: contact@getmcpads.com