Developers, agencies, and SaaS platforms that generate OAuth 2.0 refresh tokens for Google Ads users will face a new mandatory authentication step beginning next week. Google confirmed in its July 27, 2026 Google Ads Developer Blog post that passkey verification will be required for all new OAuth 2.0 refresh token generation through the Google Ads API, with the rollout beginning August 5 and expanding to all users over the following weeks.
What the Requirement Covers
Passkeys will replace password-only authentication and traditional two-factor methods such as SMS codes and time-based one-time passwords (TOTP) for the user authentication workflow. The change applies specifically to the generation of new OAuth 2.0 refresh tokens, the credentials that allow third-party applications to maintain long-term, authorized access to Google Ads accounts on behalf of users.
Existing OAuth refresh tokens will continue to work and will not require reauthorization. Applications already connected to Google Ads accounts through previously issued tokens are not disrupted by the change. Applications using service accounts for automated workflows are also not affected.
The Seven-Day Trust Delay
A timing consideration is built into the new requirement. A newly created passkey may be subject to a seven-day security delay before becoming fully trusted, and Google recommends creating a passkey ahead of time to avoid delays when new authentication is required.
For developers and agencies onboarding new users immediately after the August 5 rollout date, that delay has direct operational consequences. A user who creates a passkey on the day they need to authenticate may not be able to complete token generation for up to a week.
Downstream Products Also Affected
The passkey requirement extends beyond direct API access. The requirement will extend to other Google Ads products that rely on the Google Ads API, including Google Ads Editor, Google Ads Scripts, BigQuery Data Transfer Service, and Looker Studio, and users accessing these tools without a passkey will be prompted to create one.
This makes the scope of the change broader than a back-end API update. Advertisers and analysts using Looker Studio or BigQuery Data Transfer Service to pull Google Ads data may encounter a passkey prompt the next time they authorize access through a new user credential.
Part of a Wider Google Ads Security Push
The August 5 API requirement is the latest in a series of Google Ads authentication changes in 2026. The extension of a mandatory passkey requirement to sensitive Google Ads actions represents the next stage of a platform-wide transition for the advertising platform specifically. Google replaced password-based login with biometric authentication for sensitive operations carrying the highest risk of unauthorized changes, with the mandate designed to block phishing and account hijacking, the primary attack vector for unauthorized billing changes and campaign manipulation.
Version 24.1 of the Google Ads API, released on May 13, 2026, introduced a new boolean field called `passkey_enabled` that indicates whether the authenticated user has a passkey configured. Developers building integrations that touch sensitive account operations can check this field programmatically before attempting those operations, enabling conditional handling when a user has not yet enrolled.
How Passkey Authentication Works
A fingerprint sensor, facial recognition system, or screen lock PIN verifies the user's identity locally. The biometric data never leaves the device and is never transmitted to Google. What gets transmitted instead is a cryptographic proof that the user has physical possession of the registered device and is able to unlock it, a combination that is resistant to remote phishing attacks.
Practical Implications for Agencies and Developers
Agencies and development teams managing onboarding flows for new Google Ads users should audit their token-generation processes before August 5. Users who have not yet created a passkey will be prompted to do so during the authentication flow, and the potential seven-day trust delay means that same-day token generation cannot be guaranteed for new passkey enrollees. Proactively directing new users to set up a passkey at g.co/passkeys before they need to authenticate is the most reliable way to avoid onboarding delays. Teams using service accounts for automated or offline workflows require no changes.
Google's July 27 Developer Blog post states that users who encounter issues with the new authentication requirement can contact Google Ads support, and that further discussion is available through the Google Advertising and Measurement Community Discord server.
