Security & Authentication
The OrbiAds MCP server is secured by Google OAuth 2.0. Each request is authenticated through the Google OAuth session of your MCP client, linked to your Firebase UID (the same Google account you used for registration). GAM credentials are encrypted via Google KMS and stored in Firestore. No password or GAM token is ever transmitted in plain text.
Security & Privacy Architecture
How we protect your write access to Google Ad Manager.
1. OAuth 2.0 consent
Privacy FirstSecure direct sign-in through Google OAuth 2.0.
- OrbiAds never has access to your Google credentials or passwords.
- You explicitly authorize access to your Google Ad Manager network.
- Immediate, full revocation in 1 click from your Google account (myaccount.google.com/security) or from OrbiAds.
Zero passwords stored
We never have access to your Google or Ad Manager credentials. Everything relies on the OAuth2 protocol.
Revocable in 1 click
You can permanently cut the connection at any time. Access is revoked instantly at Google's level.
Tenant isolation
Each encrypted token is logically isolated by user UID on our servers and inaccessible to other accounts.
GAM Data Storage & Non-Retention Policy
What we NEVER store (live API calls)
- Your original creative files: Banners, HTML5 and video files stay hosted on your servers or are indexed directly.
- Your budgets and campaigns: OrbiAds keeps no persistent copy of your insertion orders or the financial details of GAM campaigns.
- Live inventory structure: Your Ad Units, Key-Values and placements are read on the fly, in real time, through the GAM API.
What we store (only to run OrbiAds)
- The KMS-encrypted access token: Required to authenticate with Google and operate the network on your behalf.
- Your Blueprints & Templates: Your target inventory configurations (Blueprints) and your custom OrbiAds report templates.
- Audit logs & credits: Tool execution timestamps, jobId and credits consumed, needed for your billing and audit trail.
Google OAuth2
Registration and login only via your Google account. Each tenant is isolated.
- No password stored
- Isolation by Firebase UID
KMS Encryption
GAM OAuth tokens are encrypted at rest via Cloud KMS. Never accessible in plain text.
// Example KMS workflow
1. Receive GAM access token
2. Encrypt via Cloud KMS (OrbiAds KeyRing)
3. Store the encrypted blob in Firestore
Full Audit
All operations are logged with tenant_id, jobId, timestamp, and credit cost.