Google makes passkeys mandatory for Google Ads API users

Google is making passkeys mandatory for users generating caller OAuth 2.0 refresh tokens done the Google Ads API, portion of a broader push to fortify relationship information crossed Google Ads.

The rollout originates connected 5th August and will grow to each users complete the pursuing weeks.

What’s new. Going forward, users pursuing the Google Ads API’s personification authentication workflow will beryllium required to authenticate pinch a passkey erstwhile generating caller OAuth 2.0 refresh tokens.

Once the alteration takes effect:

• Passkeys will switch password-only authentication and accepted two-factor methods specified arsenic SMS codes and time-based one-time passwords (TOTP) for this workflow.
• Users without a passkey will beryllium prompted to create 1 during authentication.
• Existing OAuth refresh tokens will proceed to activity and won’t require reauthorisation.
• A recently created passkey whitethorn beryllium taxable to a seven-day information hold earlier becoming afloat trusted.

Google recommends creating a passkey up of clip to debar delays erstwhile caller authentication is required.

Why we care. While astir advertisers won’t announcement the change, developers, agencies and SaaS platforms that make OAuth refresh tokens for Google Ads users will request to prepare. Teams onboarding caller users aft the rollout should relationship for the passkey requirement—and the imaginable seven-day spot period—to debar unexpected delays. Applications utilizing work accounts for automated workflows are not affected.

Also affected. The passkey request will widen to different Google Ads products that trust connected the Google Ads API, including:

• Google Ads Editor.
• Google Ads Scripts.
• BigQuery Data Transfer Service.
• Looker Studio.

Users accessing these devices without a passkey will beryllium prompted to create one.

Bottom line. Starting successful August, passkeys will go the modular authentication method for generating caller Google Ads API refresh tokens. Existing integrations will proceed working, but developers should hole caller users for the updated sign-in process earlier the rollout begins.