What is professional API access?

It means your agency holds its own approved developer access on a platform — your own Google Cloud project and developer token from your own manager account, your own Meta Developer account and your own Meta app — rather than borrowing a key from a client or operating on someone else's app. It is what separates a demo from work you can run for many clients.

Does Outloop give me a developer token or a Meta app?

No. Outloop provides no shared developer account, no shared app, and no shared token, and it cannot shorten or influence Business Verification, App Review, Advanced Access, or a Google Ads access-level decision. Your agency owns the developer identity. Outloop starts once your own approved credentials are connected: it pins them to the right client resource, keeps them away from the agent, and audits every request.

How long does platform approval take?

That is the platform's decision, not ours. Google publishes review windows for its Google Ads API access levels — check its current documentation rather than a number on someone else's site. Meta publishes no guaranteed time for Business Verification or App Review. Plan around the dependency rather than a date, and start the long poles first.

Can I do anything useful before approval comes through?

Usually yes, and it is the difference between waiting and progressing. On Google Ads, lower access levels already reach test accounts, and Explorer Access reaches production accounts at a lower daily limit — often enough for a read-only first proof. On Meta, Standard Access lets you make real calls with people who hold a role on your app, which is also how you satisfy the requirement to have called each permission before submitting for review. Meanwhile you can finish OAuth, collect the client resource IDs, and decide your approval boundaries.

Is read-only the limit of what Outloop can do?

No. A safe read is the first proof, because it verifies identity, resource pinning and redaction without changing anything. Approved write operations run through Outloop once the required permissions are in place, with workspace-to-resource pinning, action classification, a redacted audit trail, and human or destructive-action gates.

Should I ever use another agency's developer app or token?

No. Google states that if you use a third-party app or service, the developer of that app needs its own token, and usually grants one token per company. Meta expects the business operating an app to own and be verified for it. Beyond policy, borrowed developer access means you cannot control permissions, review status, or revocation — and you inherit someone else's compliance record.

Learn · Platform readiness

Professional API access readiness

Last updated: August 7, 2026

In short

Professional API access means your agency holds its own approved developer access on a platform — not a key borrowed from a client, and not someone else's app.

It arrives in four stages: platform developer readiness, client account and resource access, connection to Outloop, and a first safe proof. The first two are decided by Google or Meta on their own timelines and are owned entirely by your agency. The last two are what Outloop does.

Open in: ChatGPT Claude Perplexity

The four stages

Teams stall because they treat platform access as one long checklist. It is four different jobs with different owners, and only the last two belong to Outloop.

Platform developer readiness

Who owns it: Your agency. One-time per platform, reused across every client.

Outloop: None. Outloop cannot apply, accelerate, or guarantee an outcome.

Client account and resource access

Who owns it: Your agency, granted by the client.

Outloop: None. The platform decides what your credential can reach.

Connection to Outloop

Who owns it: Your agency, locally.

Outloop: Credentials entered once, stored in the macOS Keychain, pinned to one workspace and one client resource.

First runtime proof

Who owns it: Your agency.

Outloop: Outloop performs and audits it: correct identity and resource, a safe real read, secret_exposed:false, and a wrong-client request denied before any backend call.

Your agency owns the developer identity

On every platform, the developer identity belongs to your agency. On Google Ads that means your own Google Cloud project, your own OAuth client, and a developer token from the API Center of your own manager account — Google usually grants one token per company and states that if you use a third-party app or service, the developer of that app needs its own token. On Meta it means your own Meta Developer account and your own dedicated app, connected to your own Business Portfolio, with your own Business Verification and App Review.

Outloop provides no shared developer account, no shared app, and no shared token, and cannot shorten, accelerate or guarantee any platform decision. That is not a limitation to work around — borrowed developer access means you cannot control permissions, review status or revocation, and you inherit another company's compliance record.

Always required, versus it depends

Platform requirements are not one flat list. Some apply to every agency; others depend on the permissions you request, the access level you need, your business type, and whether the workflow reads or writes. Getting this wrong in either direction is expensive — over-requesting slows review, under-requesting means the workflow fails in production.

Google Ads

A developer token from the API Center of your own Google Ads manager account (MCC), plus your own Google Cloud project and OAuth client.

Always required

Google Ads manager account (MCC). The developer token is issued here — not from Google Cloud. You must be signed into a manager account.
Google Cloud project. A dedicated project with the Google Ads API enabled, kept separate from website or product infrastructure.
OAuth consent screen and OAuth client. Configured with a neutral, accurate app name and a business contact email.
Developer token. Requested in Tools & Settings → Setup → API Center. The application asks for company name, company URL and an API contact email.
Refresh token. The long-lived OAuth token Outloop stores locally so it can mint short-lived access tokens host-side.
Client customer ID. The specific account this workspace may touch, distinct from the MCC login customer ID.

Depends on permissions, access level, business type and intended actions

Access level. Test Account Access reaches test accounts only. Explorer Access reaches production at a lower daily limit. Basic and Standard Access are applications with Google-published review windows. You do not need the top level to run a first proof.
API token application. Required for higher access levels. Answer for what the tool actually does — internal users, the campaign types and capabilities you genuinely use.
Write capability. Budget, bid, status and structural changes stop for a named approver. Account-level deletions are blocked outright.

Timing: Google publishes its own review windows for Basic and Standard Access. Treat them as Google's figures, check the current documentation, and remember Google decides both the level and the timeline. Connect Google Ads API to Outloop covers the full step-by-step path.

Meta Ads

Your own Meta Developer account and your own dedicated Meta app, connected to your Business Portfolio, with the permissions your workflows need approved at the access level they need.

Always required

Meta Developer account. Registered to your agency.
Your own Meta app. Created in the App Dashboard, with the app type and use case that match what you actually do.
Business Portfolio. Your app connected to your own Business Portfolio.
Client asset access. Approved access to the ad account, and to the Page or Instagram business account where the workflow touches them.
An active ad account. Required to run campaigns and manage billing.

Depends on permissions, access level, business type and intended actions

Standard vs Advanced Access. Business apps receive Standard Access automatically, which only lets you request permissions from people who hold a role on your app. Production scale needs Advanced Access.
Business Verification. Required when your app requests advanced-level access and will be used to reach data belonging to businesses outside your own — the normal agency situation. It is the long pole; start it first.
App Review. Required per individual permission and feature at advanced level. Meta expects at least one successful call using each requested permission within the 30 days before you submit.
Live mode. Required before advanced-level permissions work for people without a role on your app.
System User. The right choice for unattended agency automation and the flow the setup guide documents — but not universally mandatory. Which token type you need depends on the connection flow and the assets involved.
Data Use Checkup. An annual re-certification once you hold permissions.

Timing: Meta does not publish a guaranteed review time for Business Verification or App Review, so plan around the dependency rather than a date. Outloop cannot influence either. Connect Meta Ads API to Outloop covers the full step-by-step path.

What a first proof actually proves

The first proof is deliberately small: a safe real read on the one client resource this workspace is pinned to, returning a genuine API result with secret_exposed:false, plus a request naming a different client's resource that is denied before any backend call. That single pair verifies identity, resource binding, redaction and audit at once — without changing anything in a live client account.

Read-only is the starting proof, not the permanent limit. Once the permissions are in place, approved write operations run through the same path with workspace-to-resource pinning, action classification, a redacted audit trail, and human or destructive-action gates. What is available to any given agency depends on the permissions, access level, review outcome and assets the platform approved for that agency's own app.

A request is checked against the workspace's approved resource before the credential is used

01

Agent request

The agent asks for an approved action or alias — not a raw key.
02

Policy & tenant check

Outloop checks project, tenant identity, and runtime policy before anything runs.
03

Local broker

On approval, the local broker uses the credential on the wire to perform the call.
04

Redacted result

The agent receives a sanitized, non-secret result. Raw values never enter its context.
05

Audit log

Every attempt is written to a redacted local audit — decision, tenant, service.

The agent never sees the credential. A wrong-tenant request is denied at the policy check, before any backend call.

Never put a credential anywhere but the credential flow

Platform setup produces secrets: OAuth client secrets, refresh tokens, developer tokens, access tokens. Create them on the platform, then enter them once into the Outloop app on your Mac, where they are stored in the macOS Keychain and used host-side. Never paste one into a chat, a prompt, a Skill, a .env file, a repository, a project folder, a document, a screenshot, or an email to support — including ours.

Sources

Related: workspace-to-resource binding, wrong-client access in agent loops, the capability catalog, and Outloop for AI marketing agencies. Platform requirements change — every claim above links its official source, and the page carries the date it was last checked.

Your access, your approvals, the right client every time.

Outloop is available with guided onboarding for AI agencies, operators, and dev shops.

Start 14-day trial