Marketing for a Cloud client
This guide walks through setting up the Marketing app for a client on Vocion Cloud, end to end. The worked example is Slate, a screen recording product from Metacto: its search ads run in their own Google Ads account, its sign-ups are tracked on its own site, and a Marketing lead in its own Vocion workspace reports every morning.
The order matters. Each step below unblocks the next one.
| Step | Who does it | What the client does |
|---|---|---|
| 1. A manager account and a client ad account | Agency (once) and Vocion | Nothing, or one form |
| 2. Google Ads API access for the Cloud project | Agency (once) | Nothing |
| 3. Conversion tracking on the client's site | Vocion | Nothing |
| 4. A Vocion Cloud workspace | Vocion | Accept the invite |
| 5. The Marketing app | Vocion | Nothing |
| 6. Connect Google Ads | Client | Log in with Google, pick the account |
1. A manager account and a client ad account
Run every client from one Google Ads manager account (an MCC). Each client gets its own ad account under it.
- Why its own account: the client's campaigns, conversions and billing stay separate from everyone else's. The client's Vocion workspace connects that one account, so nothing has to be filtered by campaign name.
- Creating the manager account: the agency's owner does this once at ads.google.com/home/tools/manager-accounts. Google does not let anything create the first manager account for you.
- Creating a client account: with Basic API access (step 2), Vocion creates the client account under the manager and links it. Without it, someone at the agency adds it from the manager's Accounts page in about a minute.
- Billing: the client account needs a payment profile before Google enables it. It can share the agency's profile or carry the client's own.
- An account that already exists: link it under the manager instead. With Basic access, Vocion sends the link request and accepts it.
2. Google Ads API access
Since 9 September 2026, Google no longer issues developer tokens. Access to the Google Ads API belongs to the Google Cloud project that owns the sign-in app, and it comes in levels.
| Level | What it allows |
|---|---|
| Test | Test accounts only |
| Explorer | Reading and running campaigns on real accounts, with a daily operations limit shared by every client |
| Basic | Everything Explorer does, plus creating and linking client accounts, with a higher limit |
Apply on the Google Ads API overview page of the project in Cloud Console. Explorer is usually approved automatically. Basic needs brand verification first:
- Make the sign-in app public: on the Audience page, set the user type to External and publish the app. An internal app only serves the agency's own domain, and clients sign in from theirs.
- Prove you own the home page: the home page on the Branding page must be verified to the project owner's Google account in Search Console. Verifying the bare domain may not be enough; verify the exact address you entered, such as
https://www.example.com/. - Leave the logo out: Google reviews logos strictly, and a simple mark can be rejected as not identifying the brand. Brand verification does not need a logo, so remove it and add one later.
- Verify branding, then apply for Basic. Google reviews Basic within minutes once branding is verified.
Your Vocion Cloud administrator points the server's Google sign-in at this same project, so every Cloud workspace that connects Google Ads gets its access level.
3. Conversion tracking on the client's site
The Marketing lead steers by sign-ups, so the client's site has to report them to the client's own ad account.
- The Google tag on every page: load the tag once per page, with the client's Google Analytics ID and the Google Ads ID (
AW-…). On the landing pages it records the ad click in a first-party cookie, so the click is still known when the visitor signs up later. - The sign-up conversion: when a new account is created, send the conversion event with the label from the client's "Sign up" conversion action, and pass the person's email so Google can match it (enhanced conversions; Google hashes it before it leaves the browser). Fire it only for a new account, and only in production.
- Consent and opt-out: if a visitor has turned ad tracking off, whether through the browser's privacy signal or the site's own privacy choices, don't load the ads tag and don't send the conversion. Analytics can keep running without its advertising features.
- The site's security policy: if the site sends a Content-Security-Policy, allow the Google tag and its reporting hosts (
googletagmanager.com,google-analytics.com,googleadservices.com,doubleclick.net). A policy that blocks them fails silently: the page loads, and nothing is counted. - Make it the account's main goal: in a dedicated client account, "Sign up" is the primary conversion, so bidding and reports both use it.
Check it before trusting the numbers: load a landing page with a test click ID and confirm the click cookie is set, then confirm the sign-up page's live code carries the conversion label. The first real sign-up from an ad confirms the whole path in Google Ads.
4. A Vocion Cloud workspace
The client gets their own Org on Vocion Cloud, with one shared workspace set to their time zone. The client's admin receives an invite by email and taps Accept. An existing Vocion login joins the new Org without a new password.
The time zone matters: the daily update and every schedule run on the workspace's clock, through daylight saving.
5. The Marketing app
Turn on Marketing from the workspace's Apps page. One click sets up the whole app:
- the Marketing lead, who becomes the workspace lead when the workspace only has the general one
- the daily update on weekday mornings, emailed when it is finished, never on a timer
- a Saturday summary of the week
- a guard every four hours that alerts on an ad Google limited, spend running off pace, and the first conversion
- the accountable person, the admin who turned the app on, unless someone is already set. Updates go to them, and an admin can change it on the Members page.
Don't build these by hand on a Cloud workspace. A workspace set up from a folder of files is treated as managed by that folder, and one-click installs are then refused.
6. Connect Google Ads
This is the client's part, about a minute:
- In the workspace, open Manage workspace → Connectors → Google Ads and choose Log in with Google. Approve the Google Ads permission.
- Pick the client's account from the list. Accounts under a manager are listed with it, and choosing one fills in the manager for you.
There is nothing to paste: no keys, tokens or account numbers.
What happens next
The first update arrives the next weekday morning on the workspace's Briefings page and in the accountable person's inbox. It covers what was spent, what it bought, search terms that wasted money, ads Google limited, the changes waiting for approval, and one recommendation.
Every change to the account, including a budget, a keyword, a negative, ad text or a new campaign, comes as a card the client approves. Google checks the change before it applies, and every change can be undone. Nothing that spends money changes on its own.
Related
- Marketing: the app's pages, tools and daily update in detail
- Apps overview: how apps attach to workspaces