Google is ending password only access to the Google Ads API. Starting August 5, users who generate new OAuth 2.0 refresh tokens through the API’s standard authentication workflow will be required to set up a passkey, and older methods, including SMS codes and time based one time passwords, will no longer be accepted for that step. The rollout expands to all affected users over the following weeks, and the change also reaches tools built on top of the API, including Google Ads Editor, Ads scripts, and BigQuery Data Transfer Service.
Existing OAuth refresh tokens keep working without reauthorization, so agencies and platforms already connected are not immediately affected. New connections are where the requirement bites, and Google is warning developers to create a passkey ahead of time: a newly created one can carry a seven day security delay before it is fully trusted, which is enough to stall an urgent account setup if a team waits until the deadline.
The context matters more than the mechanism. This follows a wave of account takeover scams that used fake Google login pages to hijack ad accounts and drain budgets, serious enough that Google is willing to break backward compatibility for millions of integrations to close it. Service account workflows, the automated connections most large platforms and agencies use for bulk campaign management, are unaffected, which narrows the real impact to smaller shops and individual developers authenticating as themselves.
The original insight for marketing ops teams is where this leaves priorities: any team managing Google Ads through a personal, non service account login should set up a passkey now, not in the first week of August, since a rushed setup runs straight into that seven day trust delay during a live campaign. It also previews where identity verification is headed across ad platforms generally, in the same stretch as Google pushing AI bidding into table stakes for search ads and the industry working through a post-cookie measurement standard at the W3C. Passwords and SMS codes are becoming the weak link ad tech is engineering out.
Source: Google Ads Developer Blog
