Google is making passkeys mandatory for users who generate OAuth 2.0 renewal tokens through the Google Ads API, as part of a broader plan to strengthen account security across Google Ads.
The rollout starts on August 5th and will be extended to all users in the following weeks.
What’s new. Going forward, users following the Google Ads API user authentication workflow will be required to authenticate with a passkey when generating new OAuth 2.0 renewal tokens.
When the change takes effect:
- Passkeys will replace password-only authentication and standard two-factor authentication methods such as SMS codes and time-based one-time passwords (TOTP) for this workflow.
- Users who do not have a passkey will be prompted to create one during authentication.
- Existing OAuth refresh tokens will continue to work and will not need to be reauthorized.
- A newly generated passkey may be subject to a security delay of seven days before it is fully trusted.
Google recommends creating a login key in advance to avoid delays when new authentication is required.
Why do we care. While most advertisers won’t notice the change, developers, agencies and SaaS platforms that generate OAuth refresh tokens for Google Ads users will need to prepare. Teams onboarding new users after rollout must address the passkey requirement—and a potential seven-day trust period—to avoid unexpected delays. Applications that use automated workflow service accounts are not affected.
And it’s affected. The passkey requirement will be extended to other Google ad products that rely on the Google Ads API, including:
- Google Ads Editor.
- Google Ads Scripts.
- BigQuery data transfer service.
- Observation studio.
Users who access these tools without a passkey will be prompted to create one.
Bottom line. Starting in August, passkeys will be the standard authentication method for generating Google Ads API refresh tokens. Existing integrations will continue to work, but developers must prepare new users with an updated sign-in process before the rollout begins.
Every click wins the customer you lose.
See where competitors are investing, what keywords are driving their results, and how you can capture more of the market.
See who is stealing your traffic
Search Engine Land is owned by Semrush. We are committed to providing the highest quality of marketing articles. Unless otherwise stated, the content of this page is written by an employee or paid contractor of Semrush Inc.
