Several credentials can appear in an advertising workflow, and they are not interchangeable. An advertiser API key manages authorized ad account operations. A conversion key serves a measurement integration. An Advarde assistant connection grants access to a workspace through MCP.
Use the credential for the intended service
Do not paste a model API key into an advertiser account connection. Obtain advertiser access through the account’s supported settings and use the documented authentication scheme for that API.
Keep the advertiser account ID with the connection record. A valid credential does not remove the need to select the right account or verify that the person configuring it is authorized to manage that account.
| Credential | Used for | Where to keep it |
|---|---|---|
| Advertiser API key | Authorized OpenAI Ads account operations | Advarde account connection or server secret store |
| Conversion key | Server-side measurement requests | Destination server secret store |
| Advarde OAuth connection | Assistant access to a selected workspace | The assistant’s supported connection flow |
| Advarde workspace token | Compatible bearer-token MCP clients | Client secret configuration |
| Model API key | Model API usage | Separate from advertiser and conversion credentials |
Connect an assistant through workspace access
Open MCP connections in Advarde and use the displayed server URL. Prefer the OAuth flow when the client supports it: sign in, choose the workspace, and review access. Clients that support bearer tokens can use a scoped workspace token.
Start with a read operation that lists the account and its currency. Confirm that the returned account is the one intended for the task. Then ask the assistant to prepare a change for review before applying any consequential edit.
Keep conversion secrets out of the browser
A server-side measurement credential belongs on the destination server. Do not add it to a public tag-manager snippet, a campaign URL, an image, or a screenshot. The browser pixel ID has a different purpose and is visible in the installed code.
When documenting setup, use placeholders for secrets and show only the surrounding interface. If a credential is exposed, rotate or revoke it through the appropriate service and inspect the integration that used it.
Revoke the correct access path
Removing an assistant’s Advarde connection stops that access path; it does not necessarily rotate the upstream advertiser key. Revoke the advertiser key when that upstream credential should no longer work. Treat workspace membership, assistant authorization, and advertiser credentials as separate controls.
For an agency offboarding, remove the relevant user or assistant access, review active automation policies, and confirm who retains the advertiser account. Stopping an automation policy does not itself pause live advertising.
Document ownership and rotation
Keep a record of the credential’s purpose, owner, creation date, expiry where applicable, and dependent integration. Store the secret value in the appropriate secret store rather than in the operational document.
After rotation, test a harmless read or validation request before relying on the integration. Preserve a clear record of which connection was updated so another operator does not accidentally restore an obsolete key.
Sources and verification
Platform details checked on September 11, 2026. Your account may expose a different set of features. Examples are illustrative unless a dataset is explicitly supplied.