Reports, cost and export
How do I store an advertising platform’s access token?
In the portal under “Data connections”, in the “Return conversions” and “Receive costs” sections. You enter the token yourself and can replace or remove it at any time; Metrunio encrypts it and from then on shows only the last four characters. With Google Ads and Meta you do not need one: there you sign in at the platform.
Where do I enter my credentials for Meta, Google Ads, TikTok, LinkedIn or Microsoft Advertising?
- 01Create an access token in your ad account with the rights the purpose needs: read for cost sync, write for pushback.
- 02Under “Data connections”, open the platform’s connection in the “Receive costs” or “Return conversions” section, or use “Edit” on an existing one.
- 03Enter the token in the “Access token” field and save.
- 04A new connection starts in test mode. For cost sync, the first fetch shows whether the access works, without writing anything. For pushback, test mode sends test events or nothing at all, depending on the platform; the platform’s card says which.
What happens to the token
| Question | Answer |
|---|---|
| Method | AES-256-GCM, encrypted in the database |
| Visible | the last four characters, nothing else |
| Who can read it | the application at runtime, neither an interface nor an API |
| Another tenant | cannot decrypt it, not even through a mistake |
| Another purpose | it is stored per connection and purpose; the cost sync’s stored copy cannot be moved over to pushback |
| Log | every change is recorded in the change log: the fact, never the value |
Note
An empty token field means “leave unchanged”, not “delete”. Otherwise every other change to the same setting would take the credentials with it. It is removed only explicitly, via “Disconnect”.
Rights the token needs
- Cost sync: read access to the ad account’s reports only.
- Conversion pushback: write access to the platform’s conversion interface.
- Do not grant more than needed. A token can move budgets and switch campaigns off.
Caution
Metrunio never asks for credentials by email or in chat, and never creates accounts on the platforms. Anyone who asks you for them is not Metrunio.
Last reviewed on 12 Oct 2026
In the customer portal
Also asked
- Enter credentials
- Store access token
- Where do you keep my token?
- Change token
- Delete credentials
Related articles
- How do I sync ad spend automatically?
Can Metrunio fetch cost directly from Meta and Google Ads?
Under “Data connections” you connect an ad account, and Metrunio fetches daily cost per campaign on its own, first a few minutes after connecting, then about every six hours and retroactively, because the platforms revise their figures. “Fetch now” on the card requests an extra fetch in between. For Google Ads and Meta you sign in; for TikTok, LinkedIn and Microsoft Advertising you enter an access token, which is stored encrypted.
- Can I send conversions back to the advertising platforms?
How does conversion pushback work?
From the Growth plan, conversions go back to Meta, Google Ads, TikTok, LinkedIn and Microsoft Advertising. Matching happens exclusively through each platform’s click identifier: fbclid, gclid, ttclid, li_fat_id or msclkid. Conversions without a matching click are skipped with a stated reason. Per destination you choose whether purchases are reported with the revenue or the contribution margin, and whether only purchases by new customers go out.
- What security properties does Metrunio have?
How is separation between customers enforced?
Tenant separation is enforced in the database as well (row-level security), not only in application code. Tracking elements are signed, there is no open redirect, and signed requests are protected against replay.
- Where do I get the advertising platforms’ credentials?
Which values does Metrunio need per platform, and where do they live?
With Google Ads and Meta you sign in with your account at the platform (“Sign in with Google”, “Sign in with Meta”) and then pick the ad account or pixel from a list; no token is needed there. For TikTok, LinkedIn and Microsoft Advertising you enter an access token and one to four identifiers from your ad account. This page says in advance where each value lives.