Google Ads Mandates Passkeys Starting Aug. 5, Closing a Scam Loophole
Google Ads will require every API customer to authenticate with a passkey starting August 5, a move aimed at shutting down a scam that's been draining agency ad accounts.
Key takeaways
- Google will require all Ads API customers to set up a passkey to refresh tokens and operate accounts, effective August 5, 2026.
- New passkeys sit in a seven-day 'trust period' before Google fully trusts them, so last-minute setups won't help.
- The change targets a scam where fake sponsored login pages trick agency and martech staff into authorizing account takeovers.
- Agencies should get every team member with account access, especially new hires, onto a passkey this week, not next.
What Google Is Changing
Starting August 5, every Google Ads API customer will need a passkey, a fingerprint, face scan or device screen-lock, just to refresh a token and keep operating an account, according to AdExchanger's daily roundup, which cites Search Engine Land's reporting on the rollout.
Here's the catch that'll trip up plenty of agencies: a brand-new passkey doesn't get full trust from Google immediately. It sits in a seven-day 'trust period,' which is really more of a distrust period, before it's considered reliable. Set one up the morning of August 4 and you're still locked out on launch day.
Why This Bites Agencies and SaaS Vendors Specifically
Anyone who's run a media desk knows the real risk isn't the seasoned account lead, it's the analyst who just rotated onto an account and needs access right now. Under this system, that person can't just get added and go; they need a passkey that's already cleared its week-long probation, or they're staring at a locked dashboard mid-campaign.
This lands at an interesting moment for account governance generally, as agencies rethink how much control sits with humans versus automated systems in Google's increasingly agentic ad stack. A locked-out human operator during a live campaign is exactly the kind of gap that pushes teams toward more automated, API-driven management, ironically the same access this update is designed to protect.
It's also a good excuse to run a broader access review. If you haven't done a martech stack audit this budget season, checking who actually holds login credentials across every platform your agency touches belongs on that list too.
What to Do This Week
- Get every current account operator, especially agency staff and SaaS vendors with API access, onto a passkey now so the seven-day trust window clears before August 5.
- Flag any team member rotating onto an account in the next two weeks and get their passkey started immediately, not on their first day.
- Warn staff that a sponsored 'Google Ads login' result is a known scam vector; bookmark the real login page instead of searching for it.
Follow more Google Ads platform coverage on CMO Mag's advertising hub.
Advertiser disclosure: some links in our articles are affiliate links, and CMO Mag may earn a commission or referral fee if you sign up or buy through them, at no cost to you. It never affects our editorial coverage. See our advertising & affiliate policy.
More in Advertising
View all
Google Search Revenue Growth Slows to 17% in Q2
Alphabet's core search advertising engine cooled to 17% growth in the second quarter, snapping four consecutive quarters of acceleration and raising fresh questions about AI's bite on the click economy.
Albertsons Runs a Scripted Micro-Drama Inside Retail Media
Albertsons Media Collective and Procter & Gamble just put a 22-episode scripted series on grocery store screens, betting that retail media can carry brand storytelling, not just item-and-price ads.
Out-of-Home Advertising Formats and Costs: A 2026 Buyer's Guide
Billboards, transit wraps, digital spectaculars, and place-based screens all get lumped under one label. Here's what each actually costs, how impressions get counted, and who to call.
Discussion
No comments yet. Be the first to say something worth reading.