What happened
Google announced on its Ads Developer Blog that from August 5, generating a new OAuth 2.0 refresh token for the Google Ads API requires passkey authentication. Passwords, SMS codes, and TOTP apps stop working for this step, with the requirement rolling out to all users over the following weeks.
The reach is wider than 'API' suggests. Google names Google Ads Editor, Google Ads Scripts, the BigQuery Data Transfer Service, and Looker Studio — the everyday tools that quietly sit on refresh tokens someone generated once and forgot about.
Two things are explicitly safe: existing refresh tokens keep working with no reauthorization needed, and service accounts running automated workflows are unaffected. The trap is in the fine print — a newly created passkey can be subject to a seven-day security delay before it is fully trusted.
Why this matters
Nothing breaks on August 5. That is what makes this one dangerous. The failure arrives months later, on the day a token gets revoked, a laptop gets replaced, or someone connects a new reporting tool — and the person doing the reconnecting discovers their fresh passkey needs a week to ripen. A silent deadline with a seven-day fuse is the worst kind.
For an ecommerce operation, count what actually runs on these tokens: the Looker Studio dashboard the owner checks every Monday, the script that pauses ads on out-of-stock products, the BigQuery export feeding margin reporting. Any of those disconnecting during Q4 with a mandatory week of waiting attached is a genuinely bad day.
As a security move it is hard to argue with — accounts that control ad spend are phishing targets, and passkeys resist that. The cost is purely operational, and it only lands on teams that wait.
There is an agency-shaped wrinkle worth naming. Refresh tokens tend to be owned by whoever set up the connection years ago, and people leave. If your reporting stack was authorized under a former employee's account, the existing token still works today — but the day it gets revoked, reconnecting requires a passkey on an account nobody controls anymore. The passkey deadline is about to surface every one of those governance messes.
What to do about it
Create passkeys this week, before you need them
Every Google account used to generate tokens — yours, your agency's, the client's — should get a passkey now, while nothing is broken. The seven-day trust delay means the worst possible time to create one is during the outage it would have prevented.
Inventory your token-backed connections
List everything touching Google Ads data: Scripts, Looker Studio connectors, BigQuery transfers, Ads Editor sign-ins, third-party tools. Note which Google account owns each connection. When one drops, you want to know instantly whose passkey matters.
Move unattended automations to service accounts
Service accounts are exempt from the requirement. Anything running headless — nightly scripts, scheduled transfers — shouldn't hang off a human's login anyway. Treat this as the nudge to migrate.
Dry-run the new flow on something low-stakes
Once your passkey has cleared the trust window, regenerate one non-critical token to confirm the passkey flow works end to end with your setup. Learn the new steps on a test dashboard, not on the connection feeding your busiest campaign.