When a client will not link to your Google Ads manager account
A manager account (MCC) link is the correct way to run a client's Google Ads, and it needs no credential sharing at all — you request access, they approve, and everyone keeps their own login. The problem is entirely non-technical: some clients will not or cannot complete the link, and hand over a password instead.
Try Manager account (MCC) link first
Where this works, it is better than anything we offer: each person gets their own login, their own 2FA and their own audit trail.
- What it is called
- Manager account (MCC) link, plus Access and security levels
- Where to find it
- Google Ads → Admin → Access and security, or send a manager account link request
- Limits
- The client has to accept the link request. Manager account admins can require 2-Step Verification for sub-accounts they own.
Where that runs out
A client who does not respond to link requests, or a legacy shared agency Google identity that several staff already use. Neither is solved by telling the agency to use an MCC — they have already tried.
What Pair2FA does about it
1. Add the authenticator secret once
Scan the QR code Google shows during authenticator setup, or paste the Base32 key if it offers one. Google's documentation describes scanning only, so capture it at setup time.
2. It is encrypted before it is stored
AES-256-GCM at rest. The secret is never shown again unless someone with export permission explicitly asks for it and re-authenticates.
3. Grant only the people who need it
Viewers see the rotating six-digit code and nothing else. Access is per account, so someone working on one client never sees another. Revoking takes one click and is written to the audit log.
Google Ads team access: common questions
Why not just use a manager account?
You should, and it should be your first three attempts. It needs no shared credentials, it is revocable, and Google supports it properly. This page exists for the clients who will not complete the link.
Can I require 2FA on accounts I manage?
Yes. Google Ads manager account admins can mandate 2-Step Verification for the sub-accounts they own — worth enabling as standard.
Is sharing a Google login against Google's terms?
We have not found an explicit prohibition equivalent to Meta's or LinkedIn's, but Google accounts are designed as personal identities and a manager account link is always the better path. Treat shared access as a temporary bridge, not an arrangement.
What Pair2FA is not. It is not end-to-end encrypted. Secrets are decrypted on our server to generate codes, so a server compromise is part of the threat model. It is built to replace codes forwarded over chat and photographed QR codes, not to replace a hardware security key or a platform's own access controls. Our security page sets out the full threat model.