# Google Ads API Configuration
# Copy this file to .env and fill in your actual values

# ── Server Mode ──────────────────────────────────────────────────────
# Write tools (create/update/remove campaigns, budgets, ads, keywords, targeting)
# are disabled by default. Set to true to enable the 16 write tools.
# When false, only read (8) + workflow (7) + utility (1) = 16 tools are exposed.
GOOGLE_ADS_MCP_WRITE_ENABLED=false

# ── Write Guardrails ────────────────────────────────────────────────
# Max allowed budget change per operation (percentage). Changes above this
# are flagged as high-risk. Default: 30%
GOOGLE_ADS_MCP_MAX_BUDGET_CHANGE_PCT=30

# Hard ceiling on any single campaign daily budget (USD). Set to 0 for no limit.
# Operations that would set a budget above this value are blocked entirely.
# NOTE: This is a per-budget cap, not an aggregate account spend ceiling —
# it prevents any one budget from exceeding this amount, but does not sum
# across all campaigns in the account.
GOOGLE_ADS_MCP_ACCOUNT_DAILY_CEILING_USD=0

# ── Audit Trail ────────────────────────────────────────────────────
# Path to the JSONL audit log. Every tool call (read, write, workflow)
# is logged with timestamp, tool name, redacted arguments, outcome,
# timing, and guardrail results. Set to empty string to disable.
GOOGLE_ADS_AUDIT_LOG_PATH=audit.jsonl

# ── Rate Limiting ──────────────────────────────────────────────────
# Per-customer-ID sliding window rate limits. Prevents LLM tool-call
# loops from thrashing campaign performance or exhausting API quotas.
# Set individual limits to 0 to disable that category.
# Set ENABLED=false to disable all rate limiting.
GOOGLE_ADS_MCP_RATE_LIMIT_ENABLED=true
GOOGLE_ADS_MCP_RATE_LIMIT_READS_PER_MIN=60
GOOGLE_ADS_MCP_RATE_LIMIT_WRITES_PER_HOUR=20
GOOGLE_ADS_MCP_RATE_LIMIT_WORKFLOWS_PER_MIN=10
GOOGLE_ADS_MCP_RATE_LIMIT_BUDGET_CHANGES_PER_HOUR=0

# Required: Your Google Ads developer token
GOOGLE_ADS_DEVELOPER_TOKEN=mKmPvqWJIYTIl0lWueyx3g

# Required: OAuth2 refresh token
GOOGLE_ADS_REFRESH_TOKEN=1//01EJiiO1SOQRPCgYIARAAGAESNwF-L9IrMs2wtwjRYMEsdsKTfZSR3Fp58gDBCfqsXZmqJnu7A0EPg_oTCG1DLx1_1IpFuhxTFA4

# Required: OAuth2 client ID
GOOGLE_ADS_CLIENT_ID=620068788491-csio7hafns40kfs07rii469bb35dgetp.apps.googleusercontent.com

# Required: OAuth2 client secret
GOOGLE_ADS_CLIENT_SECRET=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

# Optional: Login customer ID (required for manager accounts)
# Use the customer ID without hyphens (e.g., 1234567890 instead of 123-456-7890)
GOOGLE_ADS_LOGIN_CUSTOMER_ID=8924781491

# Optional: Path to service account JSON key file (for service account auth)
# GOOGLE_ADS_JSON_KEY_FILE_PATH=/path/to/service_account_key.json

# Optional: Impersonated email (for service account auth)
# GOOGLE_ADS_IMPERSONATED_EMAIL=user@example.com

# Optional: API endpoint (defaults to googleads.googleapis.com)
# GOOGLE_ADS_ENDPOINT=

# Optional: Enable partial failure for batch operations
# GOOGLE_ADS_USE_PARTIAL_FAILURE=True

# Optional: Enable validate-only mode for testing
# GOOGLE_ADS_VALIDATE_ONLY=False