Google makes passkeys mandatory for Google Ads API users

Google is making passkeys obligatory for customers producing new OAuth 2.0 refresh tokens by the Google Advertisements API, a part of a broader push to strengthen account safety throughout Google Advertisements.

The rollout begins on fifth August and can increase to all customers over the next weeks.

What’s new. Going ahead, customers following the Google Advertisements API’s consumer authentication workflow might be required to authenticate with a passkey when producing new OAuth 2.0 refresh tokens.

As soon as the change takes impact:

• Passkeys will change password-only authentication and conventional two-factor strategies comparable to SMS codes and time-based one-time passwords (TOTP) for this workflow.
• Customers with out a passkey might be prompted to create one throughout authentication.
• Present OAuth refresh tokens will proceed to work and received’t require reauthorisation.
• A newly created passkey could also be topic to a seven-day safety delay earlier than turning into totally trusted.

Google recommends making a passkey forward of time to keep away from delays when new authentication is required.

Why we care. Whereas most advertisers received’t discover the change, builders, businesses and SaaS platforms that generate OAuth refresh tokens for Google Advertisements customers might want to put together. Groups onboarding new customers after the rollout ought to account for the passkey requirement—and the potential seven-day belief interval—to keep away from sudden delays. Functions utilizing service accounts for automated workflows aren’t affected.

Additionally affected. The passkey requirement will prolong to different Google Advertisements merchandise that depend on the Google Advertisements API, together with:

• Google Advertisements Editor.
• Google Advertisements Scripts.
• BigQuery Information Switch Service.
• Looker Studio.

Customers accessing these instruments with out a passkey might be prompted to create one.

Backside line. Beginning in August, passkeys will become the standard authentication method for generating new Google Ads API refresh tokens. Present integrations will proceed working, however builders ought to put together new customers for the up to date sign-in course of earlier than the rollout begins.