Google Ads API Now Requires Passkeys: What the August 2026 Mandate Means
Starting August 5, 2026, Google began rolling out a mandatory passkey requirement for the Google Ads API's user authentication workflow. Any developer, agency, or tool builder that needs to generate a new OAuth 2.0 refresh token for a Google Ads integration must now complete a passkey challenge — passwords and one-time codes no longer work for that step. Search Engine Land confirmed the rollout as part of a broader push toward phishing-resistant credentials across Google's ad infrastructure.
Existing tokens are completely unaffected. But the moment a team provisions a new connection — a new client account, a new script environment, a new developer joining the team — the passkey requirement kicks in. If you are not prepared, that moment can turn into a multi-day blocker.
What changed on August 5
The Google Ads API now mandates passkeys for the user authentication flow that issues new OAuth 2.0 refresh tokens. Specifically, password-only sign-in, SMS-based two-factor codes, and time-based one-time passwords (TOTP) are no longer accepted when generating new API credentials for user-authenticated workflows. Users who do not yet have a passkey will be prompted to create one when they first hit the new flow.
The change targets the token issuance step only. Once a refresh token exists and is stored in your application, the routine access-token refresh cycle continues exactly as before. The practical trigger is any situation where someone creates something new: a fresh agency sub-account, a new automated reporting script, a BI connector being set up for the first time, or a developer authenticating a local environment for the first time.
Google's stated rationale is clear: passkeys are phishing-resistant in a way that passwords and SMS codes simply are not. A passkey is a cryptographic key pair stored on the user's device — it cannot be typed into a fake login page, intercepted by a SIM-swap attack, or harvested from a credential-stuffing breach. For an API ecosystem that gives programmatic access to advertising accounts managing millions in spend, the upgrade is long overdue.
Which integrations are affected
The requirement applies to any tool or workflow that uses Google's user OAuth flow to generate a new refresh token. In practice, that includes:
- Google Ads Editor — when connecting a new account or re-authenticating after a credential reset
- Google Ads Scripts — when a script is set up to run under a specific user identity
- BigQuery Data Transfer Service — when configuring new Google Ads data transfers
- Looker Studio and Data Studio connectors — when a user authorizes a new Ads data source
- Custom API integrations — any application that walks a user through an OAuth consent screen to obtain a refresh token
- Third-party SaaS platforms — reporting tools, bid management software, and attribution platforms that authenticate via user credentials rather than service accounts
If you manage client accounts through an agency MCC and your onboarding flow requires a human to authorize an OAuth connection, that step now requires a passkey.
What is exempt — service accounts and existing tokens
Two categories are completely unaffected. First, service accounts — Google's recommended path for automated, server-to-server workflows — use a separate credential mechanism (a JSON key file) and are entirely exempt from the passkey mandate. If your integrations already run on service accounts, this change is irrelevant to your current operations.
Second, existing refresh tokens continue to work without any reauthorization prompt. Nobody will be locked out of a live integration. The requirement only applies at the moment of generating a new token.
The key distinction is user-authenticated flows versus service account flows. Teams that have already migrated automated workloads to service accounts — as Google has recommended for years — face no disruption here. Teams still running user-credential OAuth for automations should treat this mandate as additional pressure to complete that migration.
The seven-day passkey trust delay
There is a timing risk buried in Google's technical guidance that is easy to miss: newly created passkeys may take up to seven days before becoming fully trusted and usable for API authentication. This means a developer who creates a passkey on the morning they need to set up a new integration may find the authentication blocked for up to a week.
The implication is that passkey registration must happen before it is needed — ideally built into team onboarding and client provisioning checklists rather than handled reactively. Seven days is not a long wait until it is standing between you and a live client deadline.
Teams should also think about account governance. If a single team member holds the passkey for a shared or agency-managed account, their departure or device loss becomes an access problem. Clear policies about passkey ownership and backup recovery methods are worth establishing now rather than after the first incident.
A practical preparation checklist
Most agencies and development teams can address this in a single afternoon. Work through these steps before the mandate reaches your users:
- Audit your integrations. List every tool, script, and connector that authenticates via the Google Ads API. For each, note whether it uses user OAuth or a service account. Focus attention on the user-OAuth entries.
- Identify who generates refresh tokens. For user-OAuth integrations, find every person who might need to create a new token — developers, account managers who handle onboarding, and anyone setting up new client connections.
- Register passkeys proactively. Each identified person should create a passkey on their Google account at Google's account security settings today, not when they next need to authenticate. Account for the seven-day trust period.
- Document passkey ownership. For team-managed or shared accounts, decide who owns the passkey and what the recovery path is if that person is unavailable.
- Test the updated flow in a non-production environment. Walk through a new OAuth token generation end-to-end with a passkey before you need to do it live with a client account.
- Update client-onboarding runbooks. Any documented process for connecting new client accounts to your reporting or management tools should now include the passkey step.
- Evaluate service-account migration. If you are running any automated workflows under user credentials, the passkey mandate is a good forcing function to migrate them to service accounts — the path Google has recommended for years.
Why this matters beyond compliance
The security argument for passkeys is solid. Credential stuffing attacks — where leaked username/password combinations are tested at scale against other services — are among the most common entry vectors for advertising account takeovers. Once an attacker has a valid OAuth refresh token for a Google Ads account, they can exfiltrate audience data, redirect budgets, or inject fraudulent campaigns without triggering the usual login-alert mechanisms.
Passkeys remove the reusable secret from the equation. There is no password to leak and no one-time code to intercept. The credential lives on the device and never leaves it. For agencies managing dozens or hundreds of client accounts, the asymmetric risk is obvious: a single compromised developer credential can be a skeleton key across an entire client portfolio.
This mandate sits alongside other recent Google Ads security moves — including the block on free email accounts making sensitive Ads changes — as part of a consistent push to harden the advertising stack against credential-based attacks. The trend is clear: Google is raising the authentication floor across its ad products, and teams that have been running on legacy credential practices will face these requirements one change at a time.
For teams building or maintaining custom integrations on top of the Google Ads API — reporting dashboards, budget automation layers, custom bidding tools — authentication design is increasingly a first-class engineering concern rather than a setup afterthought. Teams that lack in-house API expertise may benefit from working with specialists in custom software development who understand both the Google Ads API surface and secure OAuth implementation patterns.
Looking ahead
Google stated the rollout "reaches all users over subsequent weeks," so if you have not yet seen the passkey prompt, you will. There is no official end date for the transition phase, but the trajectory is clear: user-credential OAuth flows for the Ads API are moving to passkeys, and password-based fallbacks will likely disappear entirely from this workflow over time.
This change arrives in the same week as Google's Content API for Shopping migration deadline — a reminder that Google's ad infrastructure is undergoing multiple simultaneous authentication and API transitions. Teams managing both advertising and merchant integrations should coordinate these changes rather than handling them in silos.
For teams running automated Google Ads workflows exclusively on service accounts, no action is needed today. For everyone else — agencies with user-OAuth onboarding flows, SaaS platforms that authenticate via user consent screens, developers who occasionally provision new connections — the two-minute task of registering a passkey now removes the risk of a multi-day blocker later. The August 17 bidding change already demands attention from Google Ads practitioners this month; this passkey mandate is one more item on the August checklist.
FAQ
Do existing Google Ads API integrations need to be updated?
No. Existing OAuth 2.0 refresh tokens continue working without any change or reauthorization. The passkey requirement applies only when generating a new refresh token — for example, when connecting a new account, setting up a new script, or a new team member authenticating for the first time.
What if a team member does not have a passkey yet?
They will be prompted to create one when they next try to authenticate via the user OAuth flow. However, a newly created passkey can take up to seven days to become fully trusted by Google's systems, so team members should register a passkey before they urgently need one — not on the day they need to provision a new integration.
Are service accounts affected by this change?
No. Service accounts use a separate credential mechanism (a JSON key file) and are entirely exempt from the passkey mandate. If your automated workflows run on service accounts, you do not need to take any action for those integrations.
Which tools are affected beyond raw API calls?
Any tool that uses the Google user OAuth flow to generate new refresh tokens is affected: Google Ads Editor, Google Ads Scripts, BigQuery Data Transfer Service, Looker Studio connectors, and third-party platforms that authenticate via user consent screens. Service-account-based integrations are exempt.
Will passwords stop working entirely for Google Ads API access?
For new OAuth token generation, yes — passwords and traditional two-factor methods (SMS codes, TOTP) are no longer accepted when creating new refresh tokens. Existing tokens still work. Over time, Google is expected to continue narrowing password-based access across its advertising products, following a broader industry direction toward passkey-only authentication.
