This guide explains the security requirements for Google Ads and Google Ads API users, including mandatory passkey authentication when generating OAuth 2.0 refresh tokens and 2-step verification (2SV) for accounts subject to manager account security mandates.
What are passkeys?
A passkey is a form of multi-factor authentication (MFA) that combines public key cryptography with your device's existing security (such as your fingerprint, face scan, or screen lock PIN) to verify an account owner's identity. Passkeys combine possession of your device ("what you have", for example, your mobile device or a FIDO2 key) with the knowledge of how to unlock the device ("what you know"), providing a convenient alternative to passwords.
Passkeys are considered more secure than standard 2SV (also known as 2-factor authentication, or 2FA) for the following reasons:
- Domain-bound: Passkeys are tied to specific domains (for example,
google.com), and won't work on fraudulent websites that impersonate the original website (for example,google-fake.com). - Device-bound: Passkeys are locked behind your device's local authentication and require the user's physical presence to be unlocked.
- No secrets to steal: Passkeys use a public-key cryptographic challenge-response method between your device and the server and don't use one-time passcodes or passwords that can be intercepted.
Set up a passkey
To set up a passkey, follow these steps:
- Go to g.co/passkeys and sign in to your Google Account.
- Click Create a passkey.
- Follow the prompts on your device to create the passkey.
Passkey requirements
The following sections detail passkey requirements for using Google Ads and the Google Ads API.
Google Ads requirements
Google Ads supports using a passkey to sign in to your account. Some advertisers may be required to use a passkey to authorize sensitive actions within their Google Ads account.
Google Ads API requirements
The Google Ads API requires all users to authenticate with a passkey when following the user authentication workflow to generate OAuth 2.0 refresh tokens. If you haven't created a passkey, you are prompted to create one (subject to a security delay of up to 7 days before the new passkey can be used to complete the authentication workflow). Other forms of authentication that use a password alone, or standard 2SV mechanisms such as Time-based One-Time Password (TOTP) or SMS-based codes, are disallowed.
Existing OAuth refresh tokens are not affected by this requirement. They continue to work as usual, and users aren't prompted for reauthorization when obtaining OAuth access tokens.
What is 2-step verification?
2-step verification (2SV), also known as 2-factor authentication (2FA), is a form of MFA that adds a second possession factor ("what you have") in addition to a username and password.
2SV is more secure than single-factor authentication systems, where authentication uses only a username and a single knowledge factor ("what you know"), typically a password. Requiring a second factor makes it harder for unauthorized users to breach your account. Passwords can be compromised, but the use of 2SV means that a compromised password by itself is not enough to gain access.
2-step verification requirements
The following sections detail 2-step verification requirements for using Google Ads and the Google Ads API.
Google Ads requirements
Google Ads supports manager account security mandates that let a manager account administrator enforce minimum security settings on all current and future sub-accounts that a manager account has administrative ownership over. One such policy lets the administrators of manager accounts require that users of owned sub-accounts enable 2-step verification on their accounts to sign in.
Google Ads API requirements
To generate OAuth 2.0 refresh tokens using the user authentication workflow, the Google Ads API requires a passkey rather than standard 2-step verification.
When a manager account enforces a 2-step verification
mandate, existing OAuth refresh tokens continue to work
without prompting users for reauthorization when obtaining OAuth access tokens.
However, Google Ads API calls to accounts subject to that mandate fail with a
TWO_STEP_VERIFICATION_NOT_ENROLLED error until the user
enables 2-step verification in their Google Account.