Google Mandates Passkeys for Google Ads API

Google is implementing a mandatory passkey requirement for users generating new OAuth 2.0 refresh tokens through the Google Ads API, a significant step in its ongoing initiative to bolster account security within the Google Ads ecosystem. This security enhancement is scheduled to commence on August 5 and will be progressively rolled out to all users over the subsequent weeks. Following the implementation of this change, the user authentication workflow for the Google Ads API will necessitate the use of a passkey for the generation of new OAuth 2.0 refresh tokens. This update signifies a shift away from password-only authentication and traditional two-factor authentication methods, such as SMS codes and time-based one-time passwords (TOTP), for this specific authentication process. Users who have not yet established a passkey will be guided through the creation process during their authentication attempt. Importantly, existing OAuth refresh tokens that are currently in use will remain functional and will not necessitate immediate reauthorization. New passkeys that are created may be subject to a security delay of up to seven days before they are considered fully trusted and operational. To mitigate potential disruptions and avoid delays when new authentication is required, Google advises users to create their passkeys in advance of the August 5 rollout. While the majority of Google Ads advertisers are unlikely to experience direct changes in their daily operations, this mandate will affect developers, agencies, and Software as a Service (SaaS) platforms that are responsible for generating OAuth refresh tokens on behalf of Google Ads users. These entities will need to adapt their onboarding processes to accommodate the passkey requirement and the potential seven-day security delay to ensure a seamless experience for new users. Applications that utilize service accounts for automated workflows are explicitly excluded from this new passkey mandate. The passkey requirement will also extend to other Google Ads products that are dependent on the Google Ads API, including Google Ads Editor, Google Ads Scripts, the BigQuery Data Transfer Service, and Looker Studio. Users attempting to access these tools without a pre-existing passkey will be prompted to create one as part of the authentication process. In essence, beginning in August, passkeys will become the standard and required method for authenticating and generating new refresh tokens for the Google Ads API, reinforcing Google's commitment to advanced account security.