A Google Ads refresh token that stops working almost always fails for one of five specific reasons, and every one of them is checkable in a few minutes. If your CRM's Google Ads sync has started throwing authentication errors — especially if it worked fine for weeks first — this is the order to check things in, from most to least common.
1. The developer token is still in test access
This is the single most common cause, and it's confusing because it doesn't fail immediately — it fails the moment you try to sync against a real (non-test) Ads account. Google issues every new developer token in test access by default, which only authenticates against Google's own test accounts. If yours hasn't been through Google's basic access application yet, every real sync will be rejected regardless of how correct your refresh token is.
Check this in Google Ads under Tools & Settings → Setup → API Center — your token's access level is shown right next to it. If it says "Test account access only", that's your answer; apply for basic access from the same screen.
2. The refresh token was generated under the wrong Google account
A refresh token is tied to whichever Google account approved the consent screen when it was generated — not to the Ads account itself. If the person who generated it (via the OAuth Playground or otherwise) doesn't actually have access to the Google Ads account whose Customer ID is entered in the CRM, the token is valid but useless for that account.
The fix is to regenerate it: sign in to ads.google.com first with the exact account that has access to the campaigns you're tracking, confirm you can see them, and only then run through the OAuth Playground flow described in connecting a Google Ads account.
3. The Google account's password changed, or access was revoked
Unlike an access token, a refresh token doesn't expire on a fixed schedule — but Google invalidates it immediately if the account owner changes their Google password, if someone removes the OAuth app's access from Google Account → Security → Third-party access, or if that person's Google Ads user access to the account itself is removed. All three look identical from the CRM's side: a token that used to work now returns an authentication error. There's no way to distinguish these without checking the Google account directly — there's nothing to fix in the CRM until a new token is generated.
4. Six months of no use
Google automatically revokes a refresh token that has gone completely unused for six months. This practically never happens to an active sync — every offline conversion upload uses it — but it can catch a company that connected the account, paused ad spend for an extended stretch, and comes back to find the connection dead. If your account has had genuinely no CRM activity for half a year, this is worth ruling out before anything else.
5. A copy-paste error in the Client ID or Client secret
The refresh token is generated against a specific OAuth client ID and secret — if those two fields in the CRM don't exactly match the ones the token was issued under, authentication fails even though every individual value looks correct in isolation. This usually happens when a Cloud Console project gets recreated, or when the client secret is regenerated in Google Cloud Console (which silently invalidates the old one). If you've ever clicked "Reset secret" in Google Cloud Console after generating your refresh token, that's almost certainly it — update both the secret and the refresh token together.
One thing that is never the cause: saving your Google Ads settings in the CRM clears the previously cached access token on purpose, so the next sync always re-authenticates from scratch with whatever you just entered. That's expected behaviour, not a bug — if a sync fails right after you save, it means one of the five things above, not that saving broke something.
How to tell which one you're looking at
Google Ads API errors are specific enough to point at the right cause: an INVALID_GRANT or
invalid_grant error almost always means causes 2 or 3 above (wrong account or revoked
access) — regenerate the token. A DEVELOPER_TOKEN_NOT_APPROVED or similar access-level
error means cause 1 — check your token's access tier. If the error mentions the client ID or an
unauthorized_client message, it's cause 5 — the client credentials and the token no longer
match.
Once you've fixed the underlying cause, go back to Marketing → Google Ads Settings, re-enter the corrected refresh token (and client secret, if that changed too), and save. The next sync will confirm whether it's resolved.