The short answer
Markitech connects through each platform’s own authorization flow, so it never sees or stores your platform passwords. The OAuth tokens it receives are encrypted at rest and never leave Markitech’s servers.
In more detail
OAuth means you sign in on Google or Meta directly, and that platform gives Markitech a token limited to the access you approved. Your password is never shared. WordPress connects with an application password, a separate credential you can revoke, not your login password.
Tokens are not exposed to the AI client or shown in chat. The AI asks Markitech to run a tool, and Markitech uses the stored token on the server side.
You can disconnect a platform at any time, and every platform also lets you revoke app access from its own security settings.
Access is limited to what you chose during each platform’s authorization step. If you connect one client account from a manager login, the AI sees that account and not the rest of the manager account.
Learn more: Marketing MCP security.
Related questions
- How does approval work in Markitech?
- What can Markitech read without asking?
- Is it safe to let AI manage ad accounts?
- How long does it take to set up Markitech?
- What is Markitech?
Key terms
Every change, approved by you
Markitech proposes each write action in chat, such as a budget change, a paused campaign or a Tag Manager publish, and holds it until you approve it. Reporting and lookups run without approval, so you can ask as many questions as you need.