Google Ads API Security Update: Passkeys Become Mandatory in August 2026
Quick Summary Google Ads API passkey authentication becomes mandatory from August 5, 2026 Passwords, TOTP, and SMS-based two-factor authentication are being disallowed for new token generation Only the user authentication workflow is affected – service account workflows are not impacted Existing OAuth 2.0 refresh tokens continue working – only new token generation requires passkey A 7-day security delay applies before a newly created passkey becomes fully operational Google Ads Editor, Ads Scripts, BigQuery Data Transfer, and Data Studio are also affected Google is changing how developers and users authenticate with the Google Ads API. Starting August 5, 2026, Google Ads API passkey authentication becomes the only accepted method when generating new OAuth 2.0 refresh tokens. This is a major update. It impacts every developer, agency, and tool that uses the user authentication workflow to access Google Ads programmatically. If your integration generates new tokens for users, you need to act now. This blog explains the Google Ads API passkey requirement. It covers who is affected, what is disallowed, and the steps to meet the August deadline. What Is the Google Ads API Passkey Requirement in 2026? A passkey is a device-based cryptographic credential that replaces passwords and traditional two-factor authentication. Instead of typing a password or entering an SMS code, your device verifies your identity using biometrics like a fingerprint or face scan, or a device PIN. From August 5, 2026, users must use a passkey for OAuth 2.0 refresh token authentication in the Google Ads API. This is part of the new security requirement during the user authentication workflow. No exceptions. Authentication Method Status After August 5, 2026 Passkey (device biometric or PIN) Required for new OAuth 2.0 refresh token generation Password only Disallowed for new token generation TOTP (Time-based One-Time Password) Disallowed as standalone two-factor authentication SMS-based authentication codes Disallowed for new token generation Service account workflow Not affected – no action required Existing OAuth 2.0 refresh tokens Continue working – no re-authorization needed Why Is Google Ads API Requiring Passkeys? The Security Logic This is part of a wider Google Ads account security overhaul that requires passkeys to authorize sensitive actions across Google Ads. Passkeys are phishing-resistant by design. Unlike passwords or TOTP codes, a passkey cannot be stolen through a phishing site or intercepted via SMS SIM-swapping. The credential stays on your device, which makes it much safer than old two-factor authentication methods. The deprecation of TOTP and SMS-based authentication removes the weakest links in the authentication chain. For agencies and developers handling client Google Ads accounts, this lowers the risk of account takeover due to hacked credentials. As AI-driven marketing tools increasingly rely on API access to manage campaigns, optimize bids, and automate reporting in real time, the accounts feeding these systems become high-value targets. A single compromised credential can expose automated workflows across dozens of client accounts at once. Locking down API authentication with passkeys ensures that as marketing teams lean further into AI-driven automation, the infrastructure behind it stays as secure as the strategies it powers. Google Ads API Service Account vs User Authentication Passkey Requirement This is the most important distinction to understand before deciding what action to take. The service account workflow is completely unaffected. If your application runs automated or offline workflows using a service account, you do not need to change anything. Google recommends using service accounts for automated pipelines. They bypass user-level authentication requirements. The user authentication workflow is where the passkey requirement applies. If your application generates OAuth 2.0 refresh tokens on behalf of users, those users will now be prompted to authenticate with a passkey when generating a new token. Users without a passkey will be asked to create one during the flow. How to Set Up a Passkey for Google Ads API Before the August Deadline The setup takes under two minutes. The critical detail is the 7-day security delay – a newly created passkey is not immediately trusted and operational. Go to g.co/passkeys in your browser (this is Google’s Security Key Manager) Sign in to your Google Account and click “Create a Passkey.” Follow the on-device steps – your device will prompt you to use a fingerprint, face scan, or PIN Confirm the passkey is saved to your device or a password manager that supports passkeys Wait for the 7-day trust period to complete before the August deadline Deadline Alert: A 7-day security delay applies before a new passkey becomes trusted. If you create your passkey on or after July 30, it may not be operational by August 5. Create it today. How to Fix a Google Ads API OAuth Passkey Error After August 5 If your integration breaks after August 5, the cause is almost certainly a new token generation attempt without a passkey in place. Here is how to resolve it. Confirm whether your app uses a user authentication workflow or a service account workflow If using user authentication, direct the affected user to create a passkey at g.co/passkeys immediately Allow the 7-day trust period to pass before retrying token generation Existing refresh tokens are unaffected – if the token was generated before August 5, it will still work Consider migrating automated integrations to the service account workflow to avoid this class of issue entirely Which Google Ads Tools and Platforms Are Also Affected by This Change? The passkey requirement extends beyond direct API access. Any Google product that uses the Google Ads API under the hood and relies on user authentication will also require passkey-based login. Platform or Tool Impact Google Ads Editor authentication Passkey required on next sign-in for new token generation Google Ads scripts authentication Affected if using user auth workflow for token generation BigQuery Data Transfer Service A passkey prompt will appear for new connections or re-authorization Looker Studio (Data Studio) connected to Google Ads Affected if user auth is involved in the connection What This Means for Agencies and Developers Managing Multiple Client Accounts If you manage Google Ads for clients through tools that use the









