Starting August 5, new OAuth 2.0 refresh tokens for Google Ads API will require passkey authentication. Existing tokens remain valid. Developers and agencies must prepare for the updated security process and potential onboarding delays.
Google is set to enforce passkey authentication for anyone generating new OAuth 2.0 refresh tokens via the Google Ads API, marking a significant shift in its account security standards. The phased rollout begins August 5, 2026, and will gradually apply to all users in the following weeks.
Under the new policy, users following the Google Ads API authentication workflow must use a passkey to create new refresh tokens. This change replaces password-only logins and traditional two-factor authentication methods, such as SMS codes and time-based one-time passwords, for this specific process. Those without a passkey will be prompted to set one up during authentication.
Existing OAuth refresh tokens are not affected and will continue to function without reauthorization. However, any newly created passkey may be subject to a seven-day security delay before it is fully trusted, potentially impacting onboarding timelines for new users. Google recommends setting up a passkey in advance to avoid these delays.
The update will also impact other products that rely on the Google Ads API, including Google Ads Editor, Google Ads Scripts, BigQuery Data Transfer Service, and Looker Studio. Users accessing these tools without a passkey will be required to create one as part of the authentication process.
While most advertisers may not notice immediate changes, developers, agencies, and SaaS platforms that generate OAuth refresh tokens for clients should review their onboarding workflows. Teams bringing on new users after the rollout must account for the passkey requirement and the possible seven-day trust period to prevent unexpected disruptions. Automated workflows using service accounts are not impacted by this update.
This move follows a broader industry trend toward stronger authentication and account protection. In a related development, Google recently expanded its Demand Gen capabilities with business data feeds, enabling dynamic ads for sectors beyond retail. For more on how Google is evolving its ad products, see this overview of new Demand Gen features for travel, real estate, and automotive advertisers.
Google's decision to make passkeys mandatory for new API refresh tokens underscores the company's ongoing efforts to enhance security for advertisers and developers. The company advises all affected users to prepare for the transition ahead of the August deadline.
Founded in 1998, Google has grown into one of the world's largest technology companies, with over 190,000 employees as of 2026. Google Ads, launched in 2000, remains a core revenue driver, generating more than $230 billion in annual ad revenue and serving millions of advertisers globally. The Google Ads API is widely used by agencies, SaaS platforms, and enterprise marketers to automate campaign management and reporting at scale.
