What Is OAuth for Ad Platforms? Secure Authentication for Conversion Uploads

OAuth (Open Authorization) is the industry-standard authentication protocol that lets The Upload Offline Conversions App (TUOCA) securely connect to your ad platform accounts — Google Ads, Meta, Microsoft Ads, and TikTok — without ever seeing or storing your password.

When you connect a destination platform in TUOCA, you’re taken to the platform’s own login page (Google, Facebook, etc.) where you authorize specific permissions. TUOCA receives a token — not your password — that provides limited, revocable access.

How OAuth Works

The Authorization Flow

1. You click "Connect Google Ads" in TUOCA
    ↓
2. TUOCA redirects you to Google's login page
    ↓
3. You log in with YOUR Google credentials (on Google's site)
    ↓
4. Google shows: "TUOCA wants to: manage offline conversions"
    ↓
5. You click "Allow"
    ↓
6. Google sends TUOCA an authorization code
    ↓
7. TUOCA exchanges the code for tokens (access + refresh)
    ↓
8. TUOCA uses the access token to upload conversions via API

Critical security point: TUOCA never sees your username or password. The login happens entirely on Google’s (or Meta’s, Microsoft’s, TikTok’s) website.

Token Types

Token	Purpose	Lifetime	Storage
Access token	Authenticates API requests	~1 hour	Temporary, in-memory
Refresh token	Gets new access tokens	Months (or until revoked)	Encrypted at rest
Authorization code	One-time code for initial setup	~10 minutes	Used once, discarded

Token Refresh Flow

Access token expires (after ~1 hour)
    ↓
TUOCA automatically sends refresh token to Google
    ↓
Google issues a new access token
    ↓
TUOCA continues uploading with no interruption

This happens transparently — you never need to re-login for routine token refreshes.

OAuth by Platform

Platform	OAuth Version	Scope Required	Token Refresh
Google Ads	OAuth 2.0	ads.readonly, adwords.readonly + conversion upload	Automatic
Meta	OAuth 2.0	ads_management, business_management	Automatic
Microsoft Ads	OAuth 2.0	msads.manage	Automatic
TikTok	OAuth 2.0	ads.management	Automatic

Why OAuth Matters for Security

Without OAuth (The Old Way)

You give TUOCA your Google username + password
    → TUOCA has full access to everything
    → If TUOCA is compromised, your entire Google account is exposed
    → You can't limit what TUOCA can do
    → Changing your password breaks the connection

With OAuth (The Secure Way)

You authorize specific permissions through Google's login
    → TUOCA has a scoped token (conversion upload only)
    → TUOCA never has your password
    → You can revoke access at any time
    → Changing your password doesn't break the connection
    → If TUOCA is compromised, only the limited scope is at risk

Common OAuth Issues

Issue	Symptom	Fix
Token expired	Uploads fail with 401 Unauthorized	TUOCA auto-refreshes; if persistent, re-authenticate
Refresh token revoked	All uploads stop, re-auth required	Re-connect the platform in TUOCA
Password changed	Refresh token may be invalidated	Re-authenticate in TUOCA settings
2FA changed	May invalidate existing tokens	Re-authenticate
Account permissions changed	Upload fails with 403 Forbidden	Verify account-level permissions
MCC access removed	Client account uploads fail	Re-link the account in the MCC

See OAuth Token Expired Reconnection Guide for troubleshooting.

TUOCA’s OAuth Permissions

TUOCA requests minimum necessary permissions:

What TUOCA CAN Do

• ✅ Read conversion action configurations
• ✅ Upload offline conversions
• ✅ Read account structure (for MCC management)
• ✅ Read campaign/ad group names (for relay configuration)

What TUOCA CANNOT Do

• ❌ Modify campaigns, budgets, or bids
• ❌ Create or delete ads
• ❌ Access billing information
• ❌ Change account settings
• ❌ Access other Google services (Gmail, Drive, etc.)

Revoking Access

You can revoke TUOCA’s access at any time:

Google Ads

1. Go to myaccount.google.com/permissions
2. Find TUOCA in the list
3. Click Remove Access

Meta

1. Go to Facebook Settings → Apps and Websites
2. Find TUOCA
3. Click Remove

Microsoft Ads

1. Go to account.microsoft.com/permissions
2. Find TUOCA
3. Click Remove permissions

Revoking access immediately stops TUOCA from uploading conversions. Your existing relay configurations are preserved, but they won’t execute until re-authenticated.

How TUOCA Handles OAuth Security

1. Encrypted storage — Refresh tokens are encrypted at rest using AES-256
2. Automatic refresh — Access tokens are refreshed automatically before expiration
3. Minimum scope — Only the permissions needed for conversion uploads are requested
4. Session isolation — Each connected account’s tokens are isolated
5. Audit logging — All authentication events are logged for security review

See Security & Compliance for TUOCA’s full security practices.