Security requirements

This guide explains the common security requirements for Google Ads and Google Ads API users.

What is 2-step verification?

2-step verification or 2SV, also known as 2-factor authentication (2FA), is a form of multi-factor authentication (MFA) that adds a second possession factor ("what you have") in addition to a username and password.

2SV is more secure than single-factor authentication systems, where authentication uses only a username and a single knowledge factor ("what you know"), typically a password. Requiring a second factor makes it harder for unauthorized users to breach your account. Passwords can be compromised, but the use of 2SV means that a compromised password by itself is not enough to gain access.

2-step verification requirements

The following sections detail 2-step verification requirements for using Google Ads and the Google Ads API.

Google Ads requirements

Google Ads supports manager account security mandates that let a manager account administrator enforce minimum security settings on all current and future sub-accounts that a manager account has administrative ownership over. One such policy lets the administrators of manager accounts require that users of owned sub-accounts enable 2-step verification on their accounts to sign in.

Existing OAuth refresh tokens are not affected by this policy, other than for calls to the Google Ads API. These tokens continue to work as usual, and users won't be prompted for reauthorization when obtaining OAuth access tokens. However, Google Ads API calls fail with a TWO_STEP_VERIFICATION_NOT_ENROLLED error until the user enables 2-step verification in their Google Account.

Google Ads API requirements

The Google Ads API requires 2SV for all its users following the user authentication workflow to generate new OAuth 2.0 refresh tokens. Users are always challenged with a second factor for authentication in addition to a username and password.

If the user doesn't have 2-step verification enabled, they are prompted to add a 2-step verification method.

Existing OAuth refresh tokens are not affected by this policy. They continue to work as usual, and users won't be prompted for reauthorization when obtaining OAuth access tokens.

What are passkeys?

A passkey is a form of multi-factor authentication that combines public key cryptography with your device's existing security (such as your fingerprint, face scan, or screen lock PIN) to verify an account owner's identity. Passkeys combine possession of your device ("what you have", for example, your mobile device or a FIDO2 key) with the knowledge of how to unlock the device ("what you know"), providing a convenient alternative to passwords.

Passkeys are considered more secure than 2FA for the following reasons:

• Domain-bound: Passkeys are tied to specific domains (for example, google.com), and won't work on fraudulent websites that impersonate the original website (for example, google-fake.com).
• Device-bound: Passkeys are locked behind your device's local authentication and require the user's physical presence to be unlocked.
• No secrets to steal: Passkeys use a public-key cryptographic challenge-response method between your device and the server and don't use one-time passcodes or passwords that can be intercepted.

How to set up a passkey

To set up a passkey:

1. Go to g.co/passkeys.
2. Click Create a Passkey to sign in to the Security Key Manager.
3. Create a passkey by following the prompts provided by your device.

Passkey requirements

The following sections detail passkey requirements for using Google Ads and the Google Ads API.

Google Ads requirements

Google Ads supports using a passkey to sign in to your account. Some advertisers may be required to use a passkey to authorize sensitive actions within their Google Ads account.

Google Ads API requirements

The Google Ads API may require some users to authenticate with passkeys. Enforced users are required to authenticate using a passkey when following the user authentication workflow to generate new OAuth 2.0 refresh tokens for the Google Ads API. If you haven't created a passkey, you are prompted to create one and use it to complete the authentication workflow. Other forms of authentication that use a password alone, or 2-factor authentication (2FA) mechanisms such as Time-based One-Time Password (TOTP) or SMS-based codes, are disallowed for enforced accounts.

Existing OAuth refresh tokens are not affected by this policy. They continue to work as usual, and users won't be prompted for reauthorization when obtaining OAuth access tokens.