Google Ads token refresh and reconnection

Google refresh tokens don't expire unless revoked. A job runs every 10 min and refreshes short-lived access tokens due within ~15 min. Reconnect restores data on rare failure.

Written By Salvatore Sinigaglia

Last updated About 4 hours ago

Google refresh tokens don't expire unless revoked. A job runs every 10 min and refreshes short-lived access tokens due within ~15 min. Reconnect restores data on rare failure.

Google Ads token refresh and reconnection

Google refresh tokens don't expire under normal operation — they live until the user explicitly revokes the app in Google Account settings. A background job runs every 10 minutes and refreshes any short-lived access token due to expire within the next ~15 minutes, silently. If refresh fails (revoked, account suspended, password reset for some apps), the token is marked EXPIRED and the connector card turns yellow with a Reconnect button. No data loss on reconnect.

Who is this for

Mediabuyers seeing a yellow card on the Google connector, admins setting up alerts, anyone who lost Google Ads sync.

How Google's OAuth differs from Meta's

AspectMetaGoogle
Access token lifetimeshort-lived, then long-lived for sync~1h (always short-lived)
Refresh token lifetimeImplicit in the long-lived tokenIndefinite (until user revokes)
Refresh mechanismExchange long-lived for a new long-lived tokenRefresh token → new access token
CadenceCron every 12h, refresh tokens expiring within 7 daysCron every 10 min, refresh tokens expiring within ~15 min

Google's model is more resilient — under normal use, your token lasts indefinitely. Failures are rare and usually require user action.

What can cause refresh to fail

  1. User revokes Wevion from Google Account settings (most common)

  2. Google Account suspended or deleted

    • Wevion has no recourse — user must resolve Google-side first
    • Then reconnect

  3. Password change (only on apps that haven't passed Google's verification)

    • Rare for Wevion (we're verified)
    • May invalidate refresh token requiring reconnect

  4. 6+ months of inactivity (only on apps under specific use criteria)

    • Unlikely in normal use — Wevion makes API calls every 15 min for sync
    • Refresh token effectively never expires from inactivity in normal usage

  5. Google deprecates an OAuth version

    • Rare migration event — Wevion forces re-OAuth on product update with announcement

Auto-refresh flow

Behind the scenes (verified in refresh-google-tokens.worker.ts + apps/backend/src/providers/google/core/constants.ts):

  • Wevion stores both refresh_token and access_token encrypted at rest (GOOGLE_TOKEN_ENCRYPTION_KEY env)
  • A job runs every 10 minutes and finds active tokens whose expires_at is within the next ~15 minutes, then calls Google's token endpoint https://oauth2.googleapis.com/token with grant_type: refresh_token
  • A new access_token is returned (1h validity)
  • The rotated access token is re-encrypted and written back to the google_token row (with the new expires_at) so it isn't stored in plaintext
  • API calls use the fresh access token
  • The refresh token is reused (Google doesn't rotate it on each refresh)

Sync continues uninterrupted. You see nothing.

When auto-refresh fails

If Wevion gets invalid_grant (or "token revoked") from Google:

  • The google_token row is marked EXPIRED
  • Connector card turns yellow with a Reconnect button
  • 15-min sync skipped for this Google user
  • Affected ad accounts marked Token expired

The refresh worker marks the token EXPIRED and logs the failure; the surfacing is in-app (yellow connector card + dashboard banner). There is no dedicated email or Telegram notification tied to Google token expiry, so keep an eye on the connector status.

How to reconnect

Step 1: Open /connect/google-ads

Find the affected Google user (yellow card).

Step 2: Click Reconnect

OAuth popup opens to Google's login screen.

Step 3: Sign in

Use the same Google account ideally (re-establishes the same data attribution).

If you use a different Google account:

  • Wevion creates a new Google user record
  • Old user remains in DB (admin can archive)
  • Sync resumes via the new user (if it has the same customer access)

Step 4: Grant scopes

Google prompts for the same scope set as the initial connect (adwords, content, openid, email, profile — see gog-101). Click Continue.

Step 5: Token saved

New refresh token saved encrypted. Card turns green. Sync resumes within 15 min.

What happens during the token-expired gap

Between failure detection and reconnect:

  • No new data syncs from Google to Wevion
  • Existing data preserved
  • Rules don't fire for affected ad accounts (stale data)
  • Cannot launch new campaigns to those accounts (publish fails)
  • Cannot edit campaigns in Wevion for those accounts
  • Existing campaigns continue running on Google (Google serves them, you're billed normally)

A 1-2 day gap is recoverable; a 7+ day gap means you've missed insights and optimization signals.

Avoid token issues

Best practices:

  • Don't revoke Wevion from Google Account settings unless you mean to disconnect
  • Use a stable Google account — one that won't be deleted when the user leaves the company. For agencies: use a long-term agency account, not the freelancer's personal Gmail
  • Connect multiple Google users for redundancy (same as Meta best practice)
  • Check the in-app connector status so an EXPIRED token doesn't go unnoticed

Reconnect with a different Google user

If the original user is permanently unavailable (left company, account deleted):

  1. Different teammate (or same teammate with different Google account) opens /connect/google-ads
  2. Clicks Connect (not Reconnect — that's tied to the original user)
  3. OAuth flow creates a new Google user record
  4. If the new user has MCC / customer access to the same accounts, sync resumes

This is the off-ramp for employee departures.

Token encryption

  • Refresh token stored encrypted at rest via AES-GCM
  • Key from GOOGLE_TOKEN_ENCRYPTION_KEY env (secret manager)
  • Never logged plaintext
  • Decrypted only at API-call time
  • Wevion staff cannot read tokens

Failure alerts

  • In-app: the connector card turns yellow (and a dashboard banner appears) when the token is marked EXPIRED

Notifications are in-app only — there is no email or Telegram alert on Google token expiry.

Google failures are mostly unpredictable (user-initiated revocation, account suspension), so there is no "N days before expiry" warning — the token is caught at the next 10-minute refresh cycle when it fails.

What you'll see

Healthy Google user:

  • Connector card: green badge, Connected
  • Last sync: recent (within last 15 min)
  • All assigned ad accounts syncing

Unhealthy Google user:

  • Yellow card: "Token expired — Reconnect"
  • Last sync: stale (> 1 hour)
  • Sync stopped for accounts attached to this user
  • Dashboard banner: "Google Ads connection needs attention"

Common issues

  • Reconnect popup blocked: enable popups for app.wevion.ai.
  • Reconnect succeeds but card stays yellow: refresh after 60s; contact support if persistent with google_user_id.
  • OAuth fails 'access_denied': user clicked Cancel in Google popup. Retry.
  • OAuth fails 'invalid_request': Wevion's OAuth app may have config issue. Contact support.
  • "Google Ads access removed": the Google user lost access in Google Ads UI (admin revoked). Re-grant in Google Ads, then reconnect.
  • Reconnect creates duplicate Google user: you authenticated with a different Google account. Choose the original or accept the duplicate (clean up old via admin action).
  • Sync didn't resume after reconnect: 15-min cycle delay. Use Force sync if available.

FAQ

Do Google Ads refresh tokens expire in Wevion?

No — under normal operation Google refresh tokens don't expire; they live until you explicitly revoke Wevion in your Google Account settings. A background job runs every 10 minutes and refreshes the short-lived access token before it expires (within a ~15-minute window), so sync continues uninterrupted. Google's model is more resilient than Meta's, and failures are rare and usually require user action.

Will I lose data when I reconnect Google Ads?

No. Reconnecting the Google connector causes no data loss — existing data is preserved. On failure the connector card turns yellow with a Reconnect button; after you sign in and grant the requested scopes, a new refresh token is saved and sync resumes within 15 minutes. The card turns green again.

What happens while my Google Ads token is expired?

While the token is expired in Wevion, no new data syncs from Google, though existing data is preserved. Rules don't fire for affected ad accounts, you can't launch or edit campaigns for those accounts, but existing campaigns keep running on Google (you're billed normally). A 1-2 day gap is recoverable; 7+ days means missed optimization signals.

How do I keep Google Ads connected if the original user leaves?

Use a stable Google account when connecting Wevion — one that won't be deleted when someone leaves the company. If the original user becomes permanently unavailable, a different teammate opens /connect/google-ads and clicks Connect (not Reconnect), creating a new Google user record. If that user has access to the same accounts, sync resumes.