Set up the paid ads agents

One message, seven asks. His pruning skill becomes the agent's rubric, and his past calls become the calibration set.

Hey Jasper, I'm building two scheduled agents: a weekly Google + Bing
keyword pruning burn-down, and a Meta sandbox creative review every 3 days.
Nothing will change an ad account without your approval. Can you send me:

1. Your keyword pruning skill: SKILL.md plus any reference files or scripts.
   And what data does it read: a Google Ads UI export, Google Ads Scripts,
   or the API?

2. Google Ads account facts: is there a manager (MCC) account, and its ID?
   The Carepatron customer ID (10 digits, 123-456-7890). Which conversion
   action you judge keywords on (sign up completed, trial, or paid)? Brand
   campaign names to exclude from pruning.

3. Bing (Microsoft Advertising): customer ID and account ID, the same
   conversion question, and who is Super Admin on the account.

4. Meta: business portfolio name and admin, ad account ID, the exact names
   of the sandbox campaign(s) and the scaling campaign, and your creative
   naming convention.

5. Targets: target cost per signup by channel (Google, Bing, Meta) and by
   region if it differs. Minimum spend before a creative or keyword gets
   judged. How many days in the sandbox counts as too long.

6. Calibration set: 3 to 5 past prunes that were clearly right, and any that
   turned out to be mistakes. Same for creatives you switched off or scaled.

7. Process: do you upload bulk CSVs via Google Ads Editor or the Microsoft
   Advertising bulk upload? Which Slack channel should reports land in? Who
   approves changes, you alone or Callum too?

Meta signups currently reach PostHog with utm_content = ad set name and utm_term = ad name, and no ad id. Names break on renames and on "- Copy" duplicates. Ask him to append this to the URL parameters on the sandbox and scaling campaigns:

These set the agent's targets and its authority. Claude can only join on PostHog sign up completed today, so flag that when you ask.

Hey Callum, setting up two paid-ads agents (weekly keyword pruning, Meta
creative review). Five questions:

1. Which conversion event is the source of truth for paid: signup, trial
   start, or paid subscription? Note: PostHog "sign up completed" is what we
   can join on today.

2. CAC / cost per signup targets by channel and region, and monthly budget
   caps.

3. Any launches, promos or seasonality windows where pruning should pause?

4. Approval authority: can Jasper approve prunes alone? Who gets the Meta
   verdicts?

5. Where should reports live: Slack channel, internal site, or both?

The Google Ads API developer token only comes from a manager (MCC) account. If Jasper says there is none, create one free with a Carepatron email that is not already tied to a Google Ads account, then link the Carepatron ad account to it.

Sign in to the manager account, open the API Center, fill in the API access form (the company website must be live and the contact email monitored), accept the terms, then copy the developer token.

You will get one of two levels:

• Explorer access is approved immediately, works on production, 2,880 operations/day. Enough for this.
• Test Account access is pending review and works on test accounts only.

Basic Access (15,000 ops/day, about 5 business days) is a later button in the same API Center. Not needed for phase 1.

Create a project named carepatron-ads-agents, then enable the Google Ads API on it.

APIs & Services → OAuth consent screen (Google Auth Platform). Choose the Internal user type if the project sits in the Carepatron Google Workspace.

APIs & Services → Credentials → Create credentials → OAuth client ID → application type Desktop app. Download the JSON (it holds the client ID and client secret) and hand it to Claude.

Claude then runs the one-time OAuth flow and hands you a URL. Sign in with a Google account that has at least read access to the Carepatron ad account. The scope requested is https://www.googleapis.com/auth/adwords. The refresh token lands in /opt/care/.env on CT105.

Fill this in and paste it to Claude. Both IDs go in without dashes.

GOOGLE_ADS_DEVELOPER_TOKEN=
GOOGLE_ADS_LOGIN_CUSTOMER_ID=   # manager (MCC) account ID, no dashes
GOOGLE_ADS_CUSTOMER_ID=         # Carepatron account, no dashes

A Super Admin on the Carepatron Microsoft Advertising account has to do this: sign in, pick the user, click Request Token. The result is a universal developer token. It grants no extra permissions of its own, so the API only sees what that user sees.

Microsoft is replacing the old page with the new one, so try the new one first.

Azure portal → App registrations → New registration. Name it carepatron-ads-agents. For supported account types pick Any Entra ID tenant + Personal Microsoft accounts. Register, then copy the Application (client) ID from the Overview page.

On the app, add a Redirect URI of type Web:

Then Certificates & secrets → New client secret → 24 months → Add.

Claude then builds the consent URL with scope openid offline_access https://ads.microsoft.com/msads.manage. Sign in as the Super Admin (MFA is enforced on Bing Ads), you land on localhost with a code, and Claude exchanges it within 5 minutes.

In the Microsoft Advertising UI open the Campaigns tab and read the two values out of the browser URL: cid= is the customer ID and aid= is the account ID.

BING_DEVELOPER_TOKEN=
BING_CLIENT_ID=          # Azure Application (client) ID
BING_CLIENT_SECRET=
BING_CUSTOMER_ID=        # cid= from the Campaigns URL
BING_ACCOUNT_ID=         # aid= from the Campaigns URL

If you want to test before production access lands, the universal sandbox developer token is BBD37VB98 against the sandbox environment.

Create App → use case Other → type Business → name it Carepatron Ads Agents → connect it to the Carepatron business portfolio. Then add the Marketing API product from the app dashboard.

No App Review is needed. For managing your own ad account, standard access to ads_read and ads_management is enough. New apps start at Limited Access (heavily rate limited per ad account, 1 system user). Full Access is granted automatically once the app has made 500 successful Marketing API calls in 15 days with an error rate under 15%, which a few weeks of the cron job reaches on its own.

Business Settings → Users → System users → Add. Name it ads-agent with role Employee. Only use Admin if you also want business_management.

On the ads-agent system user: Add assets → Ad accounts → the Carepatron ad account. For phase 1 tick View performance only, which is read access. Phase 2 needs Manage campaigns.

System user → Generate new token → select the Carepatron Ads Agents app → expiration Never → tick ads_read, ads_management and read_insights.

The ad account ID takes the form act_1234567890. Ads Manager → Account settings → Account overview shows the number.

META_SYSTEM_USER_TOKEN=
META_AD_ACCOUNT_ID=act_
META_BUSINESS_ID=

To explore Meta data today without any of this, the claude.ai Meta Ads Manager connector works interactively on the Mac. It cannot serve a cron job.

Your calls, with a suggested default for each:

• Success metric for the agents. Suggested: paid spend saved per month at flat or better signups, plus hours of manual review removed.
• Auto-apply appetite. The weekly cap on the share of spend the agent may pause without a human. Suggested cap to start: 5%.
• Attribution window. PostHog last-touch at signup, Google 30-day click, or Meta 7-day click. Suggested: report all three, rank on PostHog signups, break ties with platform conversions.
• Report destination. Slack post plus a small internal site like rfp-radar.carlosmccoy.xyz, or Slack only.

Paste this into a new Claude session, then paste or point at the credential files.

Pick up the Paid Ads Agents build. Read
06-Agent-Work/handoff-paid-ads-agents-2026-09-07.md in the exec vault.

Claude installs the credentials in /opt/care/.env on CT105 and confirms every API call works before building anything.