If you run a Google Ads account, you may have already gotten the email. Google is moving away from passwords, and starting August 19, you’ll need a passkey to do certain things inside your account.
The change itself is pretty small. The timing is what matters. A new passkey can take up to seven days before it actually works, so this isn’t something you want to leave until the last minute.
What’s a passkey?
A passkey swaps out your typed password for something your device already knows how to check. Your fingerprint, your face, or the PIN you use to unlock your screen.
The key part is that it stays on your device. It never gets sent across the internet the way a password does.
That’s what makes it hard to steal. There’s no password for someone to guess, copy, write on a sticky note, or hand over to a fake login page. If a scammer can’t get it off your phone or laptop, the most common way into an ad account closes up.
What will actually need a passkey?
Only a handful of things, all of them the kind of change you don’t make every day:
- Adding or removing users
- Changing who has access to what
- Linking or unlinking accounts
- Billing changes
That’s it. Signing in doesn’t change. You can keep using your regular password and 2-Step Verification to get into the account. Building campaigns, moving budgets, pulling reports, all of that works the same as it did yesterday.
Why Google is doing this
Ad accounts are a good target. There’s a payment method attached, money can go out fast, and someone who gets in can spend quite a bit before anybody notices.
The actions Google is protecting are exactly the ones a scammer would go for first. Quietly adding themselves as a user. Redirecting a linked account. Changing where the bill goes.
So instead of adding a hurdle to everything, Google put one in front of the few things that really matter. That seems like a reasonable trade.
The seven day wait is the part to plan for
A brand new passkey doesn’t work right away for these sensitive actions. Google holds it for up to seven days.
There’s a good reason for that. It gives Google time to run identity checks, and it means someone who just broke into an account can’t immediately set up their own passkey and lock the real owner out.
What that means for you is simple. If you need to add a team member on August 20 and you set up your passkey on August 19, you’re going to be waiting. Setting one up now takes a few minutes and makes that problem go away.
If you manage accounts for clients
A few things worth knowing:
Setting up a passkey on a manager account doesn’t cover everyone underneath it. Each person who handles these actions needs their own.
Shared logins get awkward fast. A passkey is tied to a specific person and device, so one shared login stops working well once a few people need to approve changes from different computers. The cleaner setup is to invite each person with their own email address and let them use their own passkey.
If your passkey is on your phone and you’re working on a laptop, both devices need Bluetooth turned on and need to be close together, somewhere around three to seven feet. You don’t have to pair them. They just need to see each other.
How to set one up
- Go to your Google Account security settings, or start from the Google Ads sign-in page.
- Pick the option to create a passkey and confirm your password.
- Follow the prompts to register your fingerprint, face, or screen lock PIN.
- Do the same on any other device you use for account admin work.
A hardware security key works too, if you’d rather carry a physical key than use your phone. One device is enough to meet the requirement, but setting up a second one gives you a backup if something gets lost or replaced.
Two things that trip people up. Incognito or private browsing can block the setup, so use a regular window. And auto-generated passkeys on Android can’t be used for these sensitive actions right now.
The short version
Small change, firm deadline, and a waiting period that punishes procrastination. Setting up a passkey takes a few minutes and makes your account a lot harder to steal.
If you’ve got a team or a stack of client accounts, it’s worth spending twenty minutes this week writing down who needs one and making sure they’ve got it handled. Beats sorting it out on the day you actually need to add somebody.
Sources
- Use a passkey to complete sensitive actions – Google Ads Help
- Use a passkey to log into your Google Ads account – Google Ads Help
- Google Ads To Require Passkey For Certain Sensitive Actions – Search Engine Roundtable