{"id":9364,"date":"2026-08-11T16:20:00","date_gmt":"2026-08-11T14:20:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=9364"},"modified":"2026-10-24T02:32:30","modified_gmt":"2026-10-24T00:32:30","slug":"google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/","title":{"rendered":"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations"},"content":{"rendered":"<p>Google announced a passkey requirement for the Google Ads API on 27 July 2026, with rollout starting on 5 August. The precise trigger matters: affected accounts must use a passkey when the <strong>user authentication workflow generates a new OAuth refresh token<\/strong>. The announcement does not require replacement of the OAuth client.<\/p>\n<p>Existing refresh tokens are not invalidated by this policy. Routine exchange of a valid refresh token for an access token does not require a new passkey challenge. This is not a lifetime guarantee: revocation, token limits, inactivity or other access policies can still interrupt an integration. The current security guide describes enforcement as a rollout, so an account-specific enforcement date cannot be inferred from the launch date alone.<\/p>\n<h2>1. Three different authentication situations<\/h2>\n<ul><li><strong>New user authorization:<\/strong> passkey authentication is required when enforced for the account. Password-only, SMS or TOTP authentication does not replace that challenge.<\/li><li><strong>Existing refresh token:<\/strong> the policy does not force reauthorization merely to obtain another access token.<\/li><li><strong>Service account workflow:<\/strong> unaffected by this particular requirement. Google recommends this flow for suitable automated or offline workloads. Account permissions and credential protection still apply.<\/li><\/ul>\n<p>A newly created passkey may face a seven-day trust delay. This is neither a universal account lockout nor the separate seven-day refresh-token lifetime associated with an external OAuth app in Testing status. Recovery planning must account for the actual authentication method and account policy.<\/p>\n<figure class=\"lw-diagram\"><img decoding=\"async\" src=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/quality-9364-20261024.png\" width=\"1120\" height=\"656\" loading=\"lazy\" alt=\"Three Google Ads API authentication flows and the applicable passkey requirement\"><figcaption>New user authorization, ongoing refresh-token use and service-account authentication are different flows. The passkey rule does not make every ordinary Google login a mandatory passkey login.<\/figcaption><\/figure>\n<h2>2. Keep an inventory of access, not copies of secrets<\/h2>\n<p>A small team can use a controlled document; SQLite is useful when recurring queries are needed. The following example records identities, responsibilities and references. Token values, private keys and recovery codes do not belong in this table or a repository. A service-account row should identify the actual service-account email rather than leaving the principal empty.<\/p>\n<figure style=\"--cbb-digits:2\" class=\"cbb cbb--wrap cbb--numbers wp-block-code-beautifier-block-code\" data-lang=\"sql\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">SQL<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-sql\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\"><span class=\"cbb-keyword\">CREATE<\/span> <span class=\"cbb-keyword\">TABLE<\/span> <span class=\"cbb-function\">ads_authorization<\/span> (\n<\/span><span class=\"cbb-line\">  integration <span class=\"cbb-type\">TEXT<\/span> <span class=\"cbb-keyword\">PRIMARY<\/span> <span class=\"cbb-keyword\">KEY<\/span> <span class=\"cbb-keyword\">NOT<\/span> <span class=\"cbb-constant\">NULL<\/span>,\n<\/span><span class=\"cbb-line\">  auth_type <span class=\"cbb-type\">TEXT<\/span> <span class=\"cbb-keyword\">NOT<\/span> <span class=\"cbb-constant\">NULL<\/span> <span class=\"cbb-keyword\">CHECK<\/span> (auth_type <span class=\"cbb-keyword\">IN<\/span>\n<\/span><span class=\"cbb-line\">    (<span class=\"cbb-string\">'user_account'<\/span>, <span class=\"cbb-string\">'service_account'<\/span>, <span class=\"cbb-string\">'unknown'<\/span>)),\n<\/span><span class=\"cbb-line\">  principal <span class=\"cbb-type\">TEXT<\/span>,\n<\/span><span class=\"cbb-line\">  config_path <span class=\"cbb-type\">TEXT<\/span>,\n<\/span><span class=\"cbb-line\">  token_store_reference <span class=\"cbb-type\">TEXT<\/span>,\n<\/span><span class=\"cbb-line\">  owner <span class=\"cbb-type\">TEXT<\/span> <span class=\"cbb-keyword\">NOT<\/span> <span class=\"cbb-constant\">NULL<\/span>,\n<\/span><span class=\"cbb-line\">  deputy <span class=\"cbb-type\">TEXT<\/span>,\n<\/span><span class=\"cbb-line\">  recovery_plan_reference <span class=\"cbb-type\">TEXT<\/span>,\n<\/span><span class=\"cbb-line\">  customer_ids <span class=\"cbb-type\">TEXT<\/span>,\n<\/span><span class=\"cbb-line\">  last_verified <span class=\"cbb-type\">TEXT<\/span>\n<\/span><span class=\"cbb-line\">);\n<\/span><span class=\"cbb-line\">\n<\/span><span class=\"cbb-line\"><span class=\"cbb-comment\">-- Illustrative metadata only; never insert tokens or private keys.<\/span>\n<\/span><span class=\"cbb-line\"><span class=\"cbb-keyword\">INSERT<\/span> <span class=\"cbb-keyword\">INTO<\/span> ads_authorization <span class=\"cbb-keyword\">VALUES<\/span>\n<\/span><span class=\"cbb-line\"> (<span class=\"cbb-string\">'nightly-cost-load'<\/span>, <span class=\"cbb-string\">'user_account'<\/span>, <span class=\"cbb-string\">'analyst@example.com'<\/span>,\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-string\">'\/srv\/adops\/config\/ads.yaml'<\/span>, <span class=\"cbb-string\">'vault:kv\/ads\/refresh'<\/span>,\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-string\">'analytics-team'<\/span>, <span class=\"cbb-string\">'platform-team'<\/span>, <span class=\"cbb-string\">'runbook:ads-reauthorization'<\/span>,\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-string\">'1234567890'<\/span>, <span class=\"cbb-constant\">NULL<\/span>);<\/span><\/code><\/pre><\/figure>\n<p><code>owner<\/code> names the operational responsibility. <code>deputy<\/code> names a second responsible person or team, not permission to share a personal Google identity. <code>recovery_plan_reference<\/code> points to a tested procedure: for example, reauthorization by a separately authorized user with appropriate Ads access, followed by a controlled credential change. The inventory also needs the relevant OAuth client, manager-account relationship and credential environment when several integrations share infrastructure.<\/p>\n<h2>3. Find configuration hints without printing credentials<\/h2>\n<p>A bounded file search can reveal missing inventory entries. The following GNU grep command prints filenames only and handles common quoted JSON keys, camelCase names and environment-variable names. The directory is an example and must be replaced with the explicitly approved configuration scope.<\/p>\n<figure style=\"--cbb-digits:1\" class=\"cbb cbb--wrap cbb--numbers wp-block-code-beautifier-block-code\" data-lang=\"bash\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">Shell<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-bash\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\"><span class=\"cbb-comment\"># Only an explicitly approved configuration directory; filenames only.<\/span>\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">grep<\/span> <span class=\"cbb-attr\">-rIlEi<\/span> \\\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-attr\">--include<\/span>=<span class=\"cbb-string\">'*.yaml'<\/span> <span class=\"cbb-attr\">--include<\/span>=<span class=\"cbb-string\">'*.yml'<\/span> <span class=\"cbb-attr\">--include<\/span>=<span class=\"cbb-string\">'*.json'<\/span> \\\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-attr\">--include<\/span>=<span class=\"cbb-string\">'*.env'<\/span> <span class=\"cbb-attr\">--include<\/span>=<span class=\"cbb-string\">'*.ini'<\/span> <span class=\"cbb-attr\">--include<\/span>=<span class=\"cbb-string\">'*.properties'<\/span> \\\n<\/span><span class=\"cbb-line\">  -- <span class=\"cbb-string\">'refresh&#91;_-&#93;?token|service_account|private_key_id|json_key_file_path|jsonKeyFilePath|serviceAccountSecretsPath'<\/span> \\\n<\/span><span class=\"cbb-line\">  \/srv\/adops\/config<\/span><\/code><\/pre><\/figure>\n<p>Exit 0 means matches, 1 means no matches, and 2 indicates an error. Permission errors must remain visible. A match does not establish an active Google Ads authorization: comments, examples, other APIs and obsolete files can contain the same terms. No match proves completeness either. Secret-manager references, runtime environment variables, containers, CI jobs and managed connectors may leave no matching local file.<\/p>\n<p>Each finding needs comparison with deployment configuration and the access inventory. Revoking an unknown credential immediately can break a production dependency. Ownership, actual use and a replacement or retirement plan should be established first; suspected compromise requires the applicable incident process.<\/p>\n<h2>4. Plan recovery with separate identities<\/h2>\n<ol><li>Grant each human administrator an individual account with the required Ads access. Google&#8217;s Ads guidance discourages shared identities; a deputy should not borrow another account&#8217;s passkey.<\/li><li>For user-authorized integrations, document the authorizing account and a permitted reauthorization path. A replacement user&#8217;s token has that user&#8217;s permissions and must be tested against the required customer IDs.<\/li><li>Protect refresh tokens and service credentials in the approved secret store. A server rebuild does not itself revoke a token, but loss of the credential can require reauthorization.<\/li><li>Evaluate service accounts for unattended jobs. The service account needs explicit Ads access and the integration&#8217;s required API configuration; changing the identity is not just replacing a filename. Access through a manager account may require <code>login-customer-id<\/code>.<\/li><li>Check the recovery procedure after changes in staffing, permissions, credentials or infrastructure, as well as on a regular review schedule.<\/li><\/ol>\n<p>The following SQLite query lists incomplete or outdated inventory records for both user and service accounts. The 90-day interval is an example operational policy, not a Google deadline. Dates are expected as validated <code>YYYY-MM-DD<\/code> values; unknown dates must remain visible.<\/p>\n<figure style=\"--cbb-digits:2\" class=\"cbb cbb--wrap cbb--numbers wp-block-code-beautifier-block-code\" data-lang=\"sql\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">SQL<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-sql\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\"><span class=\"cbb-keyword\">SELECT<\/span> integration, auth_type, principal, owner, customer_ids\n<\/span><span class=\"cbb-line\"><span class=\"cbb-keyword\">FROM<\/span> ads_authorization\n<\/span><span class=\"cbb-line\"><span class=\"cbb-keyword\">WHERE<\/span> auth_type = <span class=\"cbb-string\">'unknown'<\/span>\n<\/span><span class=\"cbb-line\">   <span class=\"cbb-keyword\">OR<\/span> <span class=\"cbb-function\">NULLIF<\/span>(<span class=\"cbb-function\">TRIM<\/span>(principal), <span class=\"cbb-string\">''<\/span>) <span class=\"cbb-keyword\">IS<\/span> <span class=\"cbb-constant\">NULL<\/span>\n<\/span><span class=\"cbb-line\">   <span class=\"cbb-keyword\">OR<\/span> <span class=\"cbb-function\">NULLIF<\/span>(<span class=\"cbb-function\">TRIM<\/span>(deputy), <span class=\"cbb-string\">''<\/span>) <span class=\"cbb-keyword\">IS<\/span> <span class=\"cbb-constant\">NULL<\/span>\n<\/span><span class=\"cbb-line\">   <span class=\"cbb-keyword\">OR<\/span> <span class=\"cbb-function\">NULLIF<\/span>(<span class=\"cbb-function\">TRIM<\/span>(recovery_plan_reference), <span class=\"cbb-string\">''<\/span>) <span class=\"cbb-keyword\">IS<\/span> <span class=\"cbb-constant\">NULL<\/span>\n<\/span><span class=\"cbb-line\">   <span class=\"cbb-keyword\">OR<\/span> <span class=\"cbb-type\">date<\/span>(last_verified) <span class=\"cbb-keyword\">IS<\/span> <span class=\"cbb-constant\">NULL<\/span>\n<\/span><span class=\"cbb-line\">   <span class=\"cbb-keyword\">OR<\/span> <span class=\"cbb-type\">date<\/span>(last_verified, <span class=\"cbb-string\">'+0 days'<\/span>) &lt;&gt; last_verified\n<\/span><span class=\"cbb-line\">   <span class=\"cbb-keyword\">OR<\/span> <span class=\"cbb-type\">date<\/span>(last_verified) &gt; <span class=\"cbb-type\">date<\/span>(<span class=\"cbb-string\">'now'<\/span>)\n<\/span><span class=\"cbb-line\">   <span class=\"cbb-keyword\">OR<\/span> <span class=\"cbb-type\">date<\/span>(last_verified) &lt; <span class=\"cbb-type\">date<\/span>(<span class=\"cbb-string\">'now'<\/span>, <span class=\"cbb-string\">'-90 days'<\/span>)\n<\/span><span class=\"cbb-line\"><span class=\"cbb-keyword\">ORDER<\/span> <span class=\"cbb-keyword\">BY<\/span> owner, integration;<\/span><\/code><\/pre><\/figure>\n<p>An empty result only means these stored checks passed. It does not prove that the inventory is complete, the passkey works, or Ads permissions remain sufficient. A controlled read-only access test and a documented recovery check provide separate evidence.<\/p>\n<div class=\"lw-faq\"><h2>Questions and answers<\/h2><h3>Does the change require a passkey for every Google Ads interface login?<\/h3><p>No. The API requirement concerns generation of new refresh tokens in the affected user flow. Google Ads can separately require passkeys for sensitive actions, while ordinary sign-in can still support password and two-step verification according to the account&#8217;s policies.<\/p><h3>How can the authorizing account be identified?<\/h3><p>Account app connections and, where available with the required privileges, Workspace OAuth logs help connect users to OAuth applications. Ads change events can show the user and client type for supported changes, but are not a complete authorization inventory. API change-event queries cover the past 30 days and require a limit of at most 10,000 rows; read-only reporting jobs leave no change event. These sources must be correlated with the actual deployment.<\/p><\/div><div class=\"lw-quellen\"><h2>Sources<\/h2><ul><li><a href=\"https:\/\/ads-developers.googleblog.com\/2026\/07\/passkey-authentication-requirement-for.html\">Google: Passkey authentication requirement<\/a><\/li><li><a href=\"https:\/\/developers.google.com\/google-ads\/api\/docs\/oauth\/security-requirements\">Google Ads API: Security requirements<\/a><\/li><li><a href=\"https:\/\/support.google.com\/google-ads\/answer\/16917887\">Google Ads: Passkeys for sensitive actions<\/a><\/li><li><a href=\"https:\/\/developers.google.com\/google-ads\/api\/docs\/oauth\/service-accounts\">Google Ads API: Service account workflow<\/a><\/li><li><a href=\"https:\/\/developers.google.com\/identity\/protocols\/oauth2#expiration\">Google OAuth: Refresh token expiration<\/a><\/li><li><a href=\"https:\/\/developers.google.com\/google-ads\/api\/docs\/change-event\">Google Ads API: Change events<\/a><\/li><li><a href=\"https:\/\/support.google.com\/a\/answer\/11482175\">Google Workspace: Investigation data sources<\/a><\/li><\/ul><\/div>","protected":false},"excerpt":{"rendered":"<p>The passkey requirement that started rolling out on 5 August applies to the user account behind the authorization, not to the OAuth client, and service accounts are exempt.<\/p>\n","protected":false},"author":1,"featured_media":15122,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[91386,91288,91392,91115],"class_list":["post-9364","post","type-post","status-publish","format-standard","hentry","category-digital-marketing","tag-marketing-cyfrowy-pl","tag-google-ads","tag-rest-api","tag-web-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations | Lukas Wojcik<\/title>\n<meta name=\"description\" content=\"Google Ads API and passkeys: identify affected accounts, inventory OAuth authorizations and locate forgotten access paths.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations | Lukas Wojcik\" \/>\n<meta property=\"og:description\" content=\"Google Ads API and passkeys: identify affected accounts, inventory OAuth authorizations and locate forgotten access paths.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-11T14:20:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-24T00:32:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Lukas Wojcik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lukas Wojcik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/\"},\"author\":{\"name\":\"Lukas Wojcik\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"headline\":\"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations\",\"datePublished\":\"2026-08-11T14:20:00+00:00\",\"dateModified\":\"2026-10-24T00:32:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/\"},\"wordCount\":935,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png\",\"keywords\":[\"Digital Marketing\",\"Google Ads\",\"REST API\",\"Web Security\"],\"articleSection\":[\"Digital Marketing\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/\",\"name\":\"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations | Lukas Wojcik\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png\",\"datePublished\":\"2026-08-11T14:20:00+00:00\",\"dateModified\":\"2026-10-24T00:32:30+00:00\",\"description\":\"Google Ads API and passkeys: identify affected accounts, inventory OAuth authorizations and locate forgotten access paths.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png\",\"width\":1200,\"height\":630,\"caption\":\"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"Lukas Wojcik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"Lukas Wojcik\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations | Lukas Wojcik","description":"Google Ads API and passkeys: identify affected accounts, inventory OAuth authorizations and locate forgotten access paths.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/","og_locale":"en_US","og_type":"article","og_title":"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations | Lukas Wojcik","og_description":"Google Ads API and passkeys: identify affected accounts, inventory OAuth authorizations and locate forgotten access paths.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/","og_site_name":"Lukas Wojcik - Blog","article_published_time":"2026-08-11T14:20:00+00:00","article_modified_time":"2026-10-24T00:32:30+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png","type":"image\/png"}],"author":"Lukas Wojcik","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Lukas Wojcik","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/#article","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/"},"author":{"name":"Lukas Wojcik","@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"headline":"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations","datePublished":"2026-08-11T14:20:00+00:00","dateModified":"2026-10-24T00:32:30+00:00","mainEntityOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/"},"wordCount":935,"commentCount":1,"publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png","keywords":["Digital Marketing","Google Ads","REST API","Web Security"],"articleSection":["Digital Marketing"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/","name":"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations | Lukas Wojcik","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/#primaryimage"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png","datePublished":"2026-08-11T14:20:00+00:00","dateModified":"2026-10-24T00:32:30+00:00","description":"Google Ads API and passkeys: identify affected accounts, inventory OAuth authorizations and locate forgotten access paths.","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/#primaryimage","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-9364-google-ads-api-passkeys-login-not-oa-n.png","width":1200,"height":630,"caption":"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/google-ads-api-passkey-requirement-what-it-applies-to-and-how-to-find\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"Lukas Wojcik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"Lukas Wojcik"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/9364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=9364"}],"version-history":[{"count":7,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/9364\/revisions"}],"predecessor-version":[{"id":23202,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/9364\/revisions\/23202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media\/15122"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=9364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/categories?post=9364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=9364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}