"Ultimate Guide to Google Ads API Passkeys: Why They're Now Mandatory"

Enhancing Google Ads API Security with Passkeys: What You Need to Know

Google is implementing a significant security update by making passkeys mandatory for users creating new OAuth 2.0 refresh tokens through the Google Ads API. This move is part of a broader initiative to bolster account security within the Google Ads platform in 2026.

The rollout of this new security measure commences on 5th August and will gradually encompass all users in the subsequent weeks.

Latest Updates on Google Ads API Authentication

What's Changing: Moving forward, users following the Google Ads API's user authentication flow will need to authenticate using a passkey when generating new OAuth 2.0 refresh tokens.

Key Changes:

• Passkeys will supersede password-only authentication and traditional two-factor methods like SMS codes and time-based one-time passwords (TOTP) in this specific workflow.
• Users who do not have a passkey will be guided to create one during the authentication process.
• Existing OAuth refresh tokens will remain operational without requiring reauthorization.
• A newly generated passkey may undergo a seven-day security verification phase before being completely trusted.

Google strongly advises users to set up a passkey in advance to prevent any delays when new authentication is needed.

Significance of the Update: While the majority of advertisers may not directly feel the impact of this change, developers, agencies, and SaaS platforms involved in generating OAuth refresh tokens for Google Ads users will need to make necessary preparations. Teams bringing new users on board post-rollout must consider the passkey requirement and the potential seven-day trust period to avoid unforeseen delays. Notably, applications utilizing service accounts for automated processes remain unaffected by this update.

Other Affected Google Ads Products: The passkey prerequisite will also extend to other Google Ads products that rely on the Google Ads API, including Google Ads Editor, Google Ads Scripts, BigQuery Data Transfer Service, and Looker Studio. Users using these tools sans a passkey will be prompted to create one.

Takeaway: Commencing from August, passkeys will serve as the standard authentication method for generating new Google Ads API refresh tokens. While current integrations will continue to operate smoothly, developers should prepare new users for the revised sign-in process before the official rollout begins.

Explore 200+ Online Tools on MATSEOTOOLS

If you are looking to streamline your SEO strategies, enhance your digital marketing efforts, or leverage various web tools, MATSEOTOOLS offers a comprehensive suite of over 200 online tools to cater to your diverse needs. Discover a range of tools including SEO analyzers, developer aids, text and image manipulators, PDF converters, CSV editors, as well as various conversion and calculator tools. Elevate your online presence and productivity with MATSEOTOOLS today!