Google is tightening security around the systems that connect to Google Ads. From 5 August 2026, people who create new OAuth refresh tokens for the Google Ads API through a user account will need to authenticate with a passkey.
That sounds like a developer-only change, but it can reach further. Google says related products that use the API — including Google Ads Editor, Google Ads scripts, BigQuery Data Transfer Service and Looker Studio (formerly Data Studio) — will also begin requiring passkey-based authentication.
For businesses in Bath and across the South West, the sensible response is not panic. Existing refresh tokens are unaffected. The practical job is to identify who may need to reconnect an advertising tool after the rollout and make sure that person has a working passkey before it becomes urgent.
What Google is changing
A passkey replaces a password with authentication tied to a trusted device, usually confirmed with a fingerprint, face scan or device PIN. Google says passwords alone, text-message codes and time-based one-time password apps will not be accepted when an affected user creates a new OAuth refresh token.
The requirement applies to the user-authentication workflow. Service-account workflows are not affected, and Google recommends service accounts for applications that need automated or offline access.
Most importantly, existing OAuth refresh tokens should continue to work. An established reporting dashboard or integration should not suddenly fail simply because the rollout starts. The risk appears when a new user authorises access, an existing connection needs to be rebuilt, or a tool asks somebody to sign in again.
Why this matters outside the development team
Many organisations use connected services without thinking of them as API integrations. A marketing team might pull campaign data into a dashboard, run scripts that check budgets, use Ads Editor for bulk changes or allow an agency platform to manage campaigns.
If one of those connections needs fresh authorisation during a busy campaign, a missing or newly created passkey could slow the repair. Google warns that a seven-day security delay may apply before a new passkey becomes trusted and operational. Setting one up only after a connection breaks could therefore turn a minor admin task into several days of disrupted reporting or account work.
This is particularly relevant where access depends on one employee, agency contact or old shared login. Good Google Ads management should include clear ownership of account access, not just bids and advert copy.
What Bath and South West advertisers should check now
Start with a short inventory rather than changing every connection. Ask who uses Google Ads Editor, which scripts run in the account, where campaign data is exported and which dashboards or third-party platforms connect to Google Ads.
Then check the authentication method with whoever manages each tool. The useful questions are:
- Does the connection use an individual Google user account or a service account?
- Who owns that user account, and can another authorised person recover access?
- Does the user already have a passkey set up on a suitable device?
- Could the integration need a new refresh token during or after the rollout?
- Is there a record of what the connection does and whom to contact if it stops?
Do not revoke a working token merely to test the new process. Because existing tokens remain valid, unnecessary reauthorisation could create the very interruption you are trying to avoid. Document the current setup and prepare the people responsible instead.
Be careful with shared access
A passkey is another reason to move away from shared credentials. Several people using one login makes it harder to understand who approved a sensitive change, and tying a passkey to one person’s device can create a new single point of failure.
Use Google Ads access levels to give named users the permissions they need. Keep recovery details current, remove leavers promptly and make sure the business retains appropriate administrative access when an agency or contractor is involved.
If automated reporting is important, ask the technical owner whether a service-account workflow is more suitable. That is a design decision rather than a last-minute fix, so it should be assessed carefully and tested before any live connection is replaced.
A small security change worth preparing for
For many local advertisers, nothing visible will happen on 5 August. Campaigns will keep running and existing integrations should continue using their current tokens. The change matters because future authentication becomes stricter, especially at the moment a new connection or urgent repair is needed.
A half-hour review now can reveal forgotten scripts, fragile dashboards and access tied to the wrong person. It also provides a useful opportunity to check that reporting still supports the wider paid and organic search strategy, rather than collecting data nobody uses.
Google’s official developer announcement contains the technical detail and links to its passkey setup guidance. Businesses do not need to become API experts, but they should know which systems depend on Google Ads access and who is ready to authenticate them.
Source: Google Ads Developer Blog: Passkey authentication requirement for the Google Ads API
