There are two separate Google connections, and people routinely confuse them. It is worth being clear which one you actually need before you start.
- Google Ads account — lets the CRM read your campaigns and report closed sales back as offline conversions. This is the one that makes your bidding smarter.
- Google Lead Form extension — delivers leads submitted on your ads into the CRM. Needs no OAuth at all; see the separate guide for it.
This guide covers the first.
Option 1: Connect Google Ads (one click)
Go to Integrations → Google Lead Ads and press Connect your Google Ads account. Approve access on Google's screen, and you are returned to the CRM. Then press Refresh accounts, and Use this on the account your campaigns run in.
We ask only for Google Ads access. We cannot see your email, your Drive, or anything outside that account.
If you see “Google hasn't verified this app”
Google reviews every application requesting Ads access, and that review takes time. If you see the warning, choose Advanced and continue. It is not a sign anything is wrong with your account.
Connecting your lead forms at the same time
Once an account is selected, the screen lists that account's Lead Form extensions. Pressing Connect on one writes this CRM's webhook URL and key straight into the form, inside your Google Ads account — which is the step you would otherwise do by hand in the Google Ads interface. Nothing else about the form is changed.
Option 2: Manual setup, with your own credentials
Still supported, and still the right choice if you have your own Google Cloud project or a developer token already. Go to Marketing → Google Ads Settings (the same screen is listed as Google Ads Conversion API under Team → Settings). You will need five values, all of them from Google rather than from us:
- Customer ID — top right in Google Ads, digits only, no dashes
- Login customer ID — your Manager (MCC) account ID, if the account sits under one.
Leave blank for a direct account. Getting this wrong is the most common cause of a
PERMISSION_DENIEDon a token that is otherwise perfectly valid. - Developer token — Google Ads Manager account → Tools → API Center
- OAuth client ID and secret — Google Cloud Console, with the Google Ads API enabled
- Refresh token — generated once via OAuth Playground against that client
The one-click route exists precisely because that last one defeats most people. If you have already generated a refresh token and it works, there is no reason to change.
Two things only Google controls
Developer token access level. A new token starts at Basic access, which works only against test accounts. Standard access is a separate application to Google. If your credentials are correct and the API still returns nothing for a real account, this is almost always why.
App verification. The Ads scope is classed as sensitive, so Google reviews applications that request it. Until that clears, the unverified-app warning appears.
Neither is something the CRM can change, and anyone telling you otherwise is guessing.
What this unlocks, and on which plan
Offline conversion upload is available on Growth and Scale. On Starter you can still capture leads, attribute them to campaigns and keywords, and see which ads produce customers — you simply cannot report those outcomes back to Google automatically.
Once connected, map a pipeline stage to a conversion action (there is a separate guide for that), and from then on marking a lead Won reports that sale to Google with the click ID it arrived with. That is the whole point of the connection: Google stops optimising for form fills and starts optimising for the enquiries that actually became customers.
If the connection stops working later
The integration screen shows the last error Google returned, rather than going quiet. The usual cause is a revoked grant — someone removed access, changed the Google password, or the connection went unused for six months. The fix is Reconnect; it takes a few seconds and nothing is lost.