> [!NOTE] > **Note:** This guide applies only if you are using a [user authentication workflow](https://developers.google.com/google-ads/api/docs/oauth/user-authentication). This guide explains the security requirements for Google Ads and Google Ads API users, including mandatory [passkey authentication](https://developers.google.com/google-ads/api/docs/oauth/security-requirements#passkey-requirements) when generating OAuth 2.0 refresh tokens and [2-step verification (2SV)](https://developers.google.com/google-ads/api/docs/oauth/security-requirements#2sv-requirements) for accounts subject to manager account security mandates. ## What are passkeys? A passkey is a form of [multi-factor authentication](https://en.wikipedia.org/wiki/Multi-factor_authentication) (MFA) that combines public key cryptography with your device's existing security (such as your fingerprint, face scan, or screen lock PIN) to verify an account owner's identity. Passkeys combine possession of your device ("what you have", for example, your mobile device or a FIDO2 key) with the knowledge of how to unlock the device ("what you know"), providing a convenient alternative to passwords. Passkeys are considered more secure than standard 2SV (also known as 2-factor authentication, or 2FA) for the following reasons: - **Domain-bound:** Passkeys are tied to specific domains (for example, `google.com`), and won't work on fraudulent websites that impersonate the original website (for example, `google-fake.com`). - **Device-bound:** Passkeys are locked behind your device's local authentication and require the user's physical presence to be unlocked. - **No secrets to steal:** Passkeys use a public-key cryptographic challenge-response method between your device and the server and don't use one-time passcodes or passwords that can be intercepted. ### Set up a passkey > [!NOTE] > **Note:** A 7-day security delay may apply before a new passkey becomes trusted and operational. So that your passkey is ready when you need it, create it as early as possible. To set up a passkey, follow these steps: 1. Go to [g.co/passkeys](https://g.co/passkeys) and sign in to your Google Account. 2. Click **Create a passkey**. 3. Follow the prompts on your device to create the passkey. ## Passkey requirements The following sections detail passkey requirements for using Google Ads and the Google Ads API. ### Google Ads requirements Google Ads supports [using a passkey to sign in to your account](https://support.google.com/google-ads/answer/16968810). Some advertisers may be required to [use a passkey to authorize sensitive actions](https://support.google.com/google-ads/answer/16917887) within their Google Ads account. ### Google Ads API requirements The Google Ads API requires all users to authenticate with a passkey when following the [user authentication workflow](https://developers.google.com/google-ads/api/docs/oauth/user-authentication) to generate OAuth 2.0 refresh tokens. If you haven't created a passkey, you are prompted to create one (subject to a [security delay of up to 7 days](https://developers.google.com/google-ads/api/docs/oauth/security-requirements#set-up-passkey) before the new passkey can be used to complete the authentication workflow). Other forms of authentication that use a password alone, or standard 2SV mechanisms such as Time-based One-Time Password (TOTP) or SMS-based codes, are disallowed. ![OAuth Passkey authentication prompt](https://developers.google.com/static/google-ads/api/images/oauth_passkey_screen.png) Existing OAuth refresh tokens are not affected by this requirement. They continue to work as usual, and users aren't prompted for reauthorization when obtaining OAuth access tokens. ## What is 2-step verification? [2-step verification](https://support.google.com/accounts/answer/185839) (2SV), also known as 2-factor authentication (2FA), is a form of MFA that adds a second possession factor ("what you have") in addition to a username and password. 2SV is more secure than single-factor authentication systems, where authentication uses only a username and a single knowledge factor ("what you know"), typically a password. Requiring a second factor makes it harder for unauthorized users to breach your account. Passwords can be compromised, but the use of 2SV means that a compromised password by itself is not enough to gain access. ## 2-step verification requirements The following sections detail 2-step verification requirements for using Google Ads and the Google Ads API. ### Google Ads requirements Google Ads supports [manager account security mandates](https://support.google.com/google-ads/answer/12865295) that let a manager account administrator enforce minimum security settings on all current and future sub-accounts that a manager account has administrative ownership over. One such policy lets the administrators of manager accounts require that users of owned sub-accounts enable 2-step verification on their accounts to sign in. ### Google Ads API requirements To generate OAuth 2.0 refresh tokens using the [user authentication workflow](https://developers.google.com/google-ads/api/docs/oauth/user-authentication), the Google Ads API requires a [passkey](https://developers.google.com/google-ads/api/docs/oauth/security-requirements#api-requirements-pk) rather than standard 2-step verification. When a manager account enforces a [2-step verification mandate](https://developers.google.com/google-ads/api/docs/oauth/security-requirements#ga-requirements-2sv), existing OAuth refresh tokens continue to work without prompting users for reauthorization when obtaining OAuth access tokens. However, Google Ads API calls to accounts subject to that mandate fail with a [`TWO_STEP_VERIFICATION_NOT_ENROLLED`](https://developers.google.com/google-ads/api/reference/rpc/v26/AuthenticationErrorEnum.AuthenticationError#two_step_verification_not_enrolled) error until the user enables 2-step verification in their Google Account.