Google Ads passkeys and 2-Step Verification: what blocks an agency link, and how to fix it

Google Ads can ask for a passkey before sensitive actions, such as account linking updates and user access changes, so the client admin who accepts an agency's manager link, or who adds an agency user, may have to create one first. Google says a new passkey takes about 1-2 days to pair with Google Ads and may be subject to a 7-day security delay. A passkey belongs to one person and one device, so a login shared by several people at an agency cannot use one.

This page is for both sides: the client admin who is stopped halfway through, and the agency waiting for the link or the invitation to go through.

Which actions ask for a passkey

Google's passkey article names account linking updates and user access changes, and in its questions adds adding new users and changing billing information, "among others". In agency work, those categories would take in:

• accepting a manager account's link request
• inviting an agency person, or changing their access level
• removing a user or a manager later

Google gives categories, not a full list of screens, so treat these as likely rather than certain.

Google does not say on which side of a manager link the prompt appears, so expect it for the agency admin who sends the request and the client admin who accepts it. Google sends an email and an in-product notice when an account requires a passkey.

A passkey is not needed to sign in. Google says you can still sign in with your password and 2-Step Verification, but without a passkey you won't be able to complete sensitive actions.

One detail confuses people who already sign in with a passkey: Google says the passkey used for the "Confirm it's you" challenge is not the same as a passkey used to sign in to your Google Account, and setting up one does not set up the other.

Set up a passkey

What you need, from Google's requirements:

• A device with a screen lock: Face ID, Touch ID or a PIN.
• A recent system: Windows 10, macOS Ventura, ChromeOS 109, Android 9.0 or iOS 16, or later. A hardware security key that supports FIDO2 also works.
• A recent browser: Chrome 109, Safari 16, Edge 109 or Firefox 122, or later, and not in Incognito or Private browsing mode, which can block the setup.
• Bluetooth on both devices when the passkey is on your phone and you work on a computer. Google says the devices should be within 1-2 meters (3-7 feet). You don't need to pair them.

The steps:

1. Go to the Passkeys and security keys page in your Google Account settings. If you are signed in to several Google accounts, check that it is the one you use for Google Ads.
2. Select Create a passkey.
3. Follow your device's steps, such as entering your PIN or scanning your fingerprint or face.

Google advises against creating a passkey on a shared device, and recommends one on every device where you do sensitive actions. On Android, Google says a passkey can be created automatically when you sign in to the device.

How long it takes to work

Google gives these figures, all from the same article:

• New passkeys take about 1-2 days to pair with Google Ads, and may be subject to a 7-day security delay.
• In its troubleshooting table: new passkeys can take 24-48 hours to pair. After 48 hours you can complete sensitive actions with another authentication method. After 7 days the passkey is fully active for all sensitive actions.
• For a personal Google account, you can approve a new passkey right away with an existing trusted passkey, or wait out a 7-day security hold.
• For a Google Workspace account, a new passkey has to be approved with an existing trusted passkey. If that is not possible, your IT administrator has to help.

So plan the passkey before the access, not on the day. An agency that is about to start with a new client can ask the client's Google Ads admin to create a passkey as soon as the work is agreed, then send the link request a couple of days later. You can see who is ready: in Google Ads, Admin > Access and security has a "Passkey status" column for each user, and a Filter for Passkey Status.

2-Step Verification and "Confirm it's you"

These are two older protections that sit next to the passkey:

• 2-Step Verification asks for a second step at sign-in: a call, the Google Authenticator app, a Google prompt on your phone, a security key or a text message. In Google Ads it is turned on as a requirement for the account under Admin > Access and security > Security tab: in the "Verification during sign-in" section, open the 2-Step Verification drop-down and select Turn on. Google says turning the requirement off needs administrative access.
• "Confirm it's you" is a check during the action itself. Google says Google Ads may prompt you once in 24 hours, for example when you invite a Standard or Admin user, and that it works independently of 2-Step Verification: turning 2-Step Verification off does not stop it. Google's article on passkeys says a passkey on your phone can answer this challenge.

Two facts for agencies:

• A manager account that owns client accounts can require 2-Step Verification on all of them, with a start date that defaults to 7 days ahead. See creating a manager account for the steps.
• Google says changes to your recovery information, such as a new phone number, may take up to 7 days to update across its services, including Google Ads, and you may see extra verification prompts in the meantime. For something urgent, Google suggests asking another administrator on the account.

Shared agency logins no longer work

Google's answer is direct: a passkey is personal, bound to one person's device and biometrics, and can't be shared among a group. Google adds that shared identities are disallowed and discouraged by policy. Its advice: "Agencies should transition to individual user access."

What that means in practice:

• At the agency: each person signs in with their own Google Account, on the agency's own domain, and is invited to the manager account with their own access level. Google says passkeys are not compatible with shared agency logins.
• At the client: link the agency's manager account, or invite the agency's people one by one. Do not create a login for the agency to share.
• Free email addresses: Google is piloting a rule that blocks addresses on free domains, such as gmail.com, from sensitive actions. A person who moves to a company address needs a new passkey for that account; the old one does not carry over.

An administrator can also enable permanent passkey verification for sensitive actions. Google says it cannot be turned off once enabled, and that external administrators cannot change or extend its enforcement date once it is confirmed. A user without a passkey on that date can still sign in, view and manage most campaigns, but is blocked from sensitive actions until they enroll one.

For tools: new API connections need a passkey too

Google's Ads API team says that people who connect a tool to Google Ads through the user sign-in flow, which creates a new OAuth 2.0 refresh token, must use a passkey. Google says a password alone, an authenticator app code or an SMS code is disallowed for that step, and a 7-day security delay may apply before a new passkey is trusted. Connections made earlier keep working, and tools that use a service account are not affected. Google lists Google Ads Editor, Google Ads scripts, BigQuery Data Transfer Service and Data Studio among the Google products that also ask for a passkey.

For an agency, this hits the person who connects the client's account to a reporting or bidding tool: give them time to set up their passkey first.

Troubleshooting

The messages below are the ones Google's passkey article lists, with its fixes.

"Something went wrong"

Update your browser to the latest version.

"Passkey not found"

Google says this can happen when a passkey was removed on the device itself. Its fix is to remove that passkey from your Google Account's security and sign-in settings too.

"Your Admin hasn't enabled passkeys for sign-in"

This banner on your Google Account security page does not stop you. Select Create a passkey under it, or Use a security key if you have one. Google says the passkey then works for Google Ads even if the banner stays.

Google says a passkey already exists

Open Passkeys and security keys in your Google Account and check "Passkeys you created" for devices you no longer own or use.

The page keeps refreshing after you create a passkey

Google says this is expected while a new passkey pairs. After 48 hours you can complete sensitive actions with another authentication method, and after 7 days the passkey is fully active.

You are asked to use the Google Authentication app

Google says this likely means you have not enrolled a passkey yet. If you have one, you may be on a new device or have Skip password when possible turned off: turn it on under Security in your Google Account, or create a passkey on that device.

You have a passkey but the challenge fails

Passkeys are device-specific. Either create one on the device you are using, or answer with your phone: when the "Confirm it's you" prompt appears, select Use another device or A different phone/tablet, scan the QR code with your phone's camera and confirm with your screen lock. The original device then refreshes and authorizes the action. A physical security key works too: insert it while the QR code is shown.

You no longer have the device with your passkey

Google's fix is to contact Google Support. A personal Google account can also wait out the 7-day security hold with a new passkey; a Workspace account needs its IT administrator.

Doing it with an access link

When an agency uses our access link, the client still signs in at Google, and Google can ask for a passkey for Google Ads. Google Ads is one sign-in, Analytics and Tag Manager another, so a client without a passkey can finish Analytics and Tag Manager first and come back to Google Ads on the same link once the passkey works. Before the first request, see the access checklist for what else to prepare.