login-customer-id

What it is

Every Google Ads API request targets a customer account. If you reach that account through a manager account (MCC), the API also needs to know which path you took; the login-customer-id header says exactly that. The value is ten digits with the dashes removed: an account shown as 123-456-7890 in the UI is sent as 1234567890.

If your credentials belong to a user with direct access to the target account, the header is usually optional. If access comes through a manager account, which is nearly every agency setup, it is mandatory.

Why it matters

Forgetting this header is the most common cause of the USER_PERMISSION_DENIED error that developers hit while the same account opens fine in the web UI; the UI resolves the context silently, the API does not.

In multi-level structures it has a subtler effect: shared budgets, cross-account conversion actions and account-level settings resolve according to the manager you logged in through. Sending the wrong MCC can return incomplete data instead of an error, which is far harder to notice.

How Tecrube uses it

Because Tecrube is a hosted connector, it resolves the manager context for you on every call. You sign in with Google once and never deal with developer tokens, header management or token refresh loops.

On the Agency plan you switch between client accounts under the manager account, each client's data stays isolated, and every applied action is logged per account.

Example

An agency asks, for twelve clients under its manager account, “report accounts missing conversion tracking and campaigns with no impressions in the last 7 days, by client.” The right manager context is set automatically for each account; the agency never writes a single header.