Why is Google Ads asking for a passkey before I can add users or link accounts, and what do I do when it won't accept mine?

TofuAnswer by the Tofu team · checked

Because Google Ads now treats changes to account access, and links between accounts, as sensitive actions. In accounts Google has notified, you need a passkey (or a FIDO2 security key) to confirm it's you before you add users, change access or link accounts. Google's email to advertisers, quoted by Search Engine Roundtable and PPC Land, gave July 15, 2026 as the start. If it won't take yours, check for a passkey still pairing (about 1 to 2 days, fully active after 7), a passkey on another device with Bluetooth off, or an Android browser, which can't complete the check.

As of October 2026.

What changed

BeforeNow
Check before a sensitive action"Confirm it's you" challenges, on all accounts since 2022: a phone prompt, a text or call code, an Android screen lock or a security keyIn accounts that require it, a passkey or a hardware security key. Without one, "you won't be able to complete sensitive actions"
Actions Google namesInviting Standard or Admin users, unusual budget or bulk changes, new ad domains or appsAccount linking updates and user access changes, plus adding new users and changing billing information, "among others"
Signing inPassword and 2-Step VerificationUnchanged. A passkey is optional for sign-in
Free email addresses (a pilot)No domain rule unless an admin set Allowed domainsUsers on @gmail.com, @yahoo.com and other free domains are blocked from sensitive actions, in enrolled accounts only
Admin controlsManager accounts could require 2-Step Verification for the accounts they ownAdmins can also make passkeys and security keys the only accepted check for sensitive actions, permanently (rolling out to some advertisers)
New Google Ads API refresh tokens2-Step VerificationA passkey for enforced users, since August 5, 2026. Google Ads Editor and scripts too

Google's help pages give no start date; they say you'll get "email and in-product notification" if your account requires a passkey. The date comes from Google's email, which Search Engine Roundtable quoted on May 8, 2026: "Starting July 15, a Google passkey will be required for performing certain sensitive actions in your account." PPC Land reported the same email on May 31, 2026. Google's email domain page calls its list of sensitive actions "non-exhaustive" and "subject to change without prior notice."

The confusing part: Google says the passkey for the "Confirm it's you" challenge "is not the same as a passkey used to sign in to your Google Account," and "setting up one does not automatically set up the other."

Google's Ads Developer Blog announced the API change on July 27, 2026, as "part of a broader change in Google Ads," covering Google Ads Editor and scripts too. Existing refresh tokens keep working and service accounts aren't affected, so you're asked for a passkey only when a tool that signs in as you creates a new token.

Who it affects

  • Accounts Google has notified. Any advertiser can set up a passkey, but "some advertisers may be required" to use one for sensitive actions.
  • Admins most. Only Admin access can give account access, change access levels, accept manager link requests and unlink manager accounts.
  • Not day-to-day work. Without a passkey you can still sign in and manage campaigns; you just can't complete sensitive actions. Free-email users can still "view reports and make routine campaign edits."
  • Accounts with several admins. Multi-party approval is a separate check: adding or removing a user or changing a role also needs a second admin's approval. Google's pages differ on when it applies: "more than 3 administrators" on its multi-party approval page, "3 or more active administrators" on its email domain page. Read-only and API users are exempt.
  • Manager accounts and agencies. When a manager account asks to link an existing, independent account, Google lists multi-party approval as "Enforced." Shared logins can't work: "A passkey is always personal."
  • SSO users. Signing in through Okta or another SSO platform doesn't exempt you; you still need a Google passkey.

What to do now

  1. See who's ready. Go to Access and security in the Admin menu and check the "Passkey status" column, or use the Filter icon, then Passkey Status. Show users in full hierarchy covers a whole manager account tree.
  2. Create a passkey on the device you use for Google Ads. On your Google Account's Passkeys and security keys page (myaccount.google.com/signinoptions/passkeys), signed in to the account you use for Google Ads, select Create a passkey. You need a screen lock, Windows 10, macOS Ventura, ChromeOS 109, Android 9 or iOS 16 or later, and Chrome 109, Safari 16, Edge 109 or Firefox 122 or later, outside Incognito or Private mode. Not on a shared device.
  3. Do it a week before you need it. Google gives about 1 to 2 days to pair in one section, 24 to 48 hours in another, and "fully active" for all sensitive actions after 7 days.
  4. Use your phone from a computer. Turn on Bluetooth on both devices and keep them within 1 to 2 meters (3 to 7 feet); no pairing needed. At the "Confirm it's you" prompt, select Use another device or A different phone/tablet and scan the QR code. Passkeys in Android browsers can't complete the check, and autogenerated Android passkeys don't work.
  5. Move free-email users to company addresses. An admin goes to Admin > Access and security, clicks the plus button and invites the company address. That login needs its own new passkey.
  6. Keep a second admin with a working passkey. Google's 2-Step Verification page gives the same advice "for urgent changes" while new recovery details settle, which can take up to 7 days.
  7. Lock it in only when everyone is ready. Where the option has reached you: select Account in the Admin menu, then the Security tab, switch "Require passkeys for sensitive actions" to "On", pick a "Required as of" date up to 30 days out, and select Confirm. No one can undo it or move the date, and SMS codes, email one-time passwords and phone prompts stop working for sensitive actions.

Why won't Google Ads accept my passkey?

What you seeWhat to do
The page refreshes or loops after you create a passkeyGoogle says it's still pairing, so wait. After 48 hours you can use another authentication method; after 7 days the passkey works for all sensitive actions. A replacement passkey is new too, so expect the same wait
It signs you in but fails in Google AdsPasskeys are device-specific. Create one on the device you're using, or use Use another device
You're asked for the Google Authentication appGoogle says you likely haven't enrolled a passkey. If you have, you may be on a new device, or "Skip password when possible" is off. Turn it on under Security and create a passkey on that device
"Passkey not found"Remove that passkey in your Google Account's Security & sign-in settings, then create a new one
"Passkey already exists"Under "Passkeys you created", remove the old entry for this device, then select Create a passkey
"Sensitive action blocked", or a 7-day waitYour Google Account holds back some sensitive actions until a new device, phone, security key or passkey has been on it 7 days. With a trusted passkey or security key already on the account, go to myaccount.google.com/security, select the new method and select Approve

For "Something went wrong," update your browser. The "Your Admin hasn't enabled passkeys for sign-in" banner is only a warning; select Create a passkey anyway.

What if I can't use a passkey at all?

Google's other routes are a FIDO2 hardware security key (insert it while the QR code shows), a passkey on your phone through the QR code, and, while a new passkey is pairing, "another authentication method" after 48 hours, unless an admin turned on permanent passkey verification. If you no longer have the device that holds your passkey, contact Google Support. Until then, another admin with a working passkey can make the change.

What does it mean for agencies adding clients?

  • One login per person, on a business email. Google tells agencies to "transition to individual user access."
  • Linking a client. In the manager account, select the Accounts icon, Sub-account settings, the plus button, Link existing account, enter the Customer ID and select Send Request. The client's admin accepts under Admin > Access and security > Managers. Google lists account linking updates as sensitive actions but doesn't say which step prompts the check, so expect one when you send the request and when the client accepts it, plus a second admin's approval where multi-party approval applies. Approval requests expire after 20 days, and Google support can't approve them for you.
  • Clients on free email. If the client's account is in the pilot, an admin on @gmail.com is blocked from account linking updates and user access changes, so expect them to need a company address before they can accept your link or add your staff.
  • Allowed domains. An account with Allowed domains set can only invite addresses on those domains, so the client may need to add yours.

Dates to watch

DateWhat happens
May 2026Google emails advertisers about passkeys (reported May 8 by Search Engine Roundtable)
July 15, 2026Passkeys required for sensitive actions, per Google's email as quoted by Search Engine Roundtable and PPC Land
August 5, 2026API, Editor and scripts requirement starts, reaching all users "over the next few weeks"
Now, no end dateThe free-email pilot and permanent passkey verification still reach only some advertisers
Sources (18)

Ask Tofu next

Pick a question and Tofu Ads Agent answers it in chat.

Related answers

More on