Google has officially announced a major security update for its advertising infrastructure. Starting August 5th, Google is making passkeys mandatory for any user generating new OAuth 2.0 refresh tokens through the Google Ads API. This mandate marks a decisive shift in how developers, agencies, and digital marketing platforms manage account access and credential security within the Google Ads ecosystem.
The transition is part of Google’s broader initiative to enforce zero-trust identity standards and eliminate weak authentication vectors across its enterprise services. While existing integrations and active tokens will remain functional without interruption, any workflow requiring new authorization tokens will soon demand passkey verification. Understanding the scope of this rollout, the technical requirements, and the practical operational impacts is essential for maintaining seamless API access across software tools and client workflows.
The Mechanics of the Google Ads API Passkey Mandate
Beginning August 5th, Google will initiate a phased rollout of the new authentication requirement, expanding it to cover all Google Ads API users over the subsequent weeks. Under this updated framework, whenever an account holder goes through the Google Ads API user authorization workflow to create a new OAuth 2.0 refresh token, they must authenticate using a registered passkey.
This mandate changes the baseline authorization process in several key ways:
- Replacement of Legacy Authentication Methods: Traditional password-only logins, alongside legacy multi-factor authentication (MFA) mechanisms—including SMS text message codes and Time-based One-Time Passwords (TOTP) from authenticator apps—will no longer be accepted for generating new user refresh tokens in this workflow.
- Mandatory Passkey Prompts: If a user attempts to complete the OAuth 2.0 authorization process without an active passkey linked to their account, Google will require them to register a passkey before proceeding.
- Grandfathered OAuth Refresh Tokens: OAuth 2.0 refresh tokens generated prior to the rollout will continue to work seamlessly. Existing production applications and background routines will not suffer sudden authorization drops or require immediate re-consent.
- Potential Seven-Day Security Delay: Newly created passkeys may trigger an automated seven-day security delay before Google recognizes them as fully trusted credentials for high-risk operations like generating new OAuth 2.0 refresh tokens.
Because of the potential seven-day trust delay, Google strongly advises marketing teams, software developers, and agency personnel to set up passkeys on their Google accounts well before needing to re-authenticate or onboard new software integrations.
Understanding Passkeys: Why Google is Phasing Out Passwords and SMS
Passkeys represent the modern industry standard for passwordless authentication, built on open standards developed by the FIDO Alliance and the World Wide Web Consortium (W3C). Rather than relying on a shared secret—such as a password stored on a server or a temporary code sent over a cellular network—passkeys utilize asymmetric public-key cryptography.
When a user registers a passkey, a cryptographic key pair is created on their personal device:
- Private Key: Stored securely on the user’s physical hardware (such as a smartphone, laptop, hardware security key, or password manager enclave) and never leaves the device.
- Public Key: Sent to Google’s servers to register the credential.
To sign in, the user verifies their local identity using biometric authentication (such as Touch ID, Face ID, or Windows Hello) or a local device PIN. The device then signs a cryptographic challenge sent by Google to prove ownership without ever transmitting the secret key across the network.
The Vulnerability of Legacy 2FA
Google’s decision to phase out SMS and TOTP for API refresh token creation stems from the persistent security risks associated with legacy two-factor authentication methods:
- SIM Swapping: Attackers can convince mobile carriers to transfer a target’s phone number to a attacker-controlled SIM card, intercepting SMS verification codes entirely.
- Adversary-in-the-Middle (AiTM) Phishing: Modern phishing kits can reverse-proxy login screens in real time, capturing both the user’s password and their TOTP authenticator code before relaying them to the legitimate service.
- Credential Stuffing: Reused passwords exposed in third-party data breaches remain a primary entry point for account takeover attacks.
Passkeys naturally block these attack vectors. Because a passkey is cryptographically bound to the specific domain (e.g., official Google authentication domains), a user cannot accidentally authenticate on a spoofed phishing site. If the domain name does not match the origin stored in the passkey cryptographic payload, the hardware device simply refuses to supply the signature.
Operational Impact on Agencies, Software Developers, and SaaS Platforms
For standard digital advertisers managing campaigns exclusively through the web interface, the day-to-day impact of this change may be minimal. However, for software engineers, agency tech leads, and MarTech SaaS developers, the mandate requires direct preparation.
Client Onboarding Friction and the 7-Day Trust Period
The most immediate operational bottleneck introduced by this policy is the seven-day trust delay for newly created passkeys. Consider a common digital agency scenario: a client hires an agency to manage their paid search campaigns, and the agency requests API access through a third-party reporting tool or custom internal platform.
If the client does not currently have a passkey configured on their Google account, they will be forced to create one during the OAuth login prompt. If Google applies the seven-day security restriction to that brand-new passkey, the client will be unable to finalize the OAuth authorization flow for a full week. This can stall client onboarding, campaign launches, and data integration projects.
To prevent these delays, agencies should proactively update their client onboarding checklists, instructing clients to register a passkey on their Google administrator accounts at least one week prior to granting API authorizations.
User Accounts vs. Service Accounts
It is important to distinguish between user authentication workflows and automated machine-to-machine integrations. Applications relying on Google Cloud Service Accounts for server-to-server operations are not affected by this passkey requirement.
Service accounts use private key pairs generated via the Google Cloud Console to interact with APIs autonomously without human intervention. Because service account workflows do not involve a human user navigating an OAuth consent screen to issue user refresh tokens, the mandatory passkey prompt does not apply to them. Developers running pure backend pipelines should confirm that their systems properly utilize Service Accounts where applicable, reducing dependence on user-bound OAuth refresh tokens.
Other Google Ads Tools Impacted by the Requirement
Because multiple applications in the Google ecosystem rely on the Google Ads API under the hood to fetch account structure and performance metrics, the mandatory passkey requirement extends beyond custom API code. The update directly impacts users logging into or authenticating the following tools:
1. Google Ads Editor
Google Ads Editor is a desktop application that enables bulk editing of search and display campaigns offline. When users add a new account or refresh their login credentials within Google Ads Editor, the software initiates an OAuth user consent flow in the web browser. If an active passkey is missing or unverified, the user must set one up to complete the login process into the desktop client.
2. Google Ads Scripts
Google Ads Scripts allow marketers to automate internal tasks using browser-based JavaScript within the Google Ads dashboard. When writing scripts that interface with external services or complex OAuth-backed resources, authorization steps requiring new user refresh tokens will enforce passkey authentication.
3. BigQuery Data Transfer Service
Enterprise data engineering teams frequently use the BigQuery Data Transfer Service to automatically stream performance data from Google Ads directly into Google Cloud BigQuery data warehouses. Setting up a new data transfer backfill or authenticating a user identity to connect BigQuery to a Google Ads account will trigger the passkey mandate.
4. Looker Studio
Looker Studio (formerly Google Data Studio) relies heavily on native Google Ads connectors to generate real-time performance reports. When a dashboard creator adds a new Google Ads data source or changes the authorization credentials powering an existing connector, they will be prompted to authenticate with a passkey before the connection is authorized.
Step-by-Step Action Plan: Preparing Your Organization
To ensure uninterrupted access to the Google Ads API and associated reporting infrastructure, organizations should execute a structured preparation plan ahead of the rollout.
Step 1: Audit Active OAuth Connections
Map out all applications, third-party MarTech tools, internal scripts, and business intelligence connectors that pull data from the Google Ads API. Determine which systems rely on user-authenticated OAuth refresh tokens versus server-level Service Accounts.
Step 2: Require Passkey Enrollment for Key Stakeholders
Enforce passkey registration across your organization for all administrators, account managers, media buyers, and developers who hold access to Google Ads accounts. Users can create a passkey by navigating to their Google Account settings under the Security tab and selecting “Passkeys and security keys.”
Step 3: Update Agency Client Onboarding Documents
Revise standard operating procedures and onboarding guides for new clients. Inform clients that Google now mandates passkey registration for third-party access grants, and provide explicit instructions for creating a passkey several days before granting software or API permissions.
Step 4: Centralize Passkey Management across Teams
In multi-user agency environments, managing passkeys across shared team accounts requires planning. Modern enterprise password managers (such as 1Password, Bitwarden, or Dashlane) now offer native support for saving and sharing passkeys securely among team members, allowing authorized personnel to complete authentication prompts without relying on a single individual’s mobile device.
Long-Term Outlook: The Shift Toward Passwordless Infrastructure
Google’s decision to require passkeys for the Google Ads API is a clear signal of where enterprise identity management is heading. As automated cyber threats, credential theft operations, and sophisticated phishing frameworks become more common, tech companies are increasingly replacing password-based access with hardware-backed, phishing-resistant credentials.
As detailed in the official announcement on the Google Ads Developer Blog, passkeys will soon serve as the baseline security standard for generating new Google Ads API refresh tokens. By configuring passkeys early, auditing API integrations, and adapting client onboarding processes now, digital marketing teams and development shops can ensure a smooth transition without service disruptions or workflow delays.