Google makes passkeys mandatory for Google Ads API users

Google is making passkeys mandatory for users generating new OAuth 2.0 refresh tokens through the Google Ads API, part of a broader push to strengthen account security across Google Ads.

The rollout begins on 5th August and will expand to all users over the following weeks.

What’s new. Going forward, users following the Google Ads API’s user authentication workflow will be required to authenticate with a passkey when generating new OAuth 2.0 refresh tokens.

Once the change takes effect:

• Passkeys will replace password-only authentication and traditional two-factor methods such as SMS codes and time-based one-time passwords (TOTP) for this workflow.
• Users without a passkey will be prompted to create one during authentication.
• Existing OAuth refresh tokens will continue to work and won’t require reauthorisation.
• A newly created passkey may be subject to a seven-day security delay before becoming fully trusted.

Google recommends creating a passkey ahead of time to avoid delays when new authentication is required.

Why we care. While most advertisers won’t notice the change, developers, agencies and SaaS platforms that generate OAuth refresh tokens for Google Ads users will need to prepare. Teams onboarding new users after the rollout should account for the passkey requirement—and the potential seven-day trust period—to avoid unexpected delays. Applications using service accounts for automated workflows are not affected.

Also affected. The passkey requirement will extend to other Google Ads products that rely on the Google Ads API, including:

• Google Ads Editor.
• Google Ads Scripts.
• BigQuery Data Transfer Service.
• Looker Studio.

Users accessing these tools without a passkey will be prompted to create one.

Bottom line. Starting in August, passkeys will become the standard authentication method for generating new Google Ads API refresh tokens. Existing integrations will continue working, but developers should prepare new users for the updated sign-in process before the rollout begins.