| Setting Up Your Google Ads Account Passkey | YT Shorts Upload - Bug 10 [Video] Stop account hijacks with Google Ads passkeys |
To view subtitles in your language, turn on YouTube captions. Select the Settings icon at the top right corner of the video player, select Captions, and then specify your language.
Passkeys are a simple and secure alternative to passwords that can’t be shared, guessed, copied, written down, or accidentally given to someone else. Using a passkey helps your most critical account settings remain secure, reducing the risk of phishing and unauthorized access.
While all advertisers can set up a passkey to sign in to your Google Ads account, you could also be required to use a passkey to confirm your identity when completing sensitive actions like account linking updates or user access changes. You’ll receive email and in-product notification if this security feature in your account requires a passkey.
This article explains the requirements to use a passkey, how to set one up, and how to troubleshoot any issues with your passkeys.
On this page
- Passkey setup requirements
- Email domain requirements
- Set up a passkey for your account
- Check the passkey setup status for users in your account
- Enforce permanent passkey verification for sensitive actions
- Complete a sensitive action on a different device
- Troubleshoot issues with passkeys
- Frequently asked questions
Passkey setup requirements
You need to set up a passkey on the primary device you use to access Google Ads, whether that's your laptop, desktop, or phone. Your device must have a screen lock, either through Face ID, Touch ID, or a PIN, to use a passkey. We recommend setting up a passkey on every device you use to access your Google Ads account, especially any device where you perform sensitive actions like billing or account changes.
Supported devices
- A computer that runs at least Windows 10, macOS Ventura, ChromeOS 109, or up
- A phone that runs Android 9.0, iOS 16 or up
- A hardware security key that supports the FIDO2 protocol. Most security keys on the market today are FIDO2 capable.
Supported browsers
- Chrome 109 or up
- Safari 16 or up
- Edge 109 or up
- Firefox 122 or up
Ensure your browser isn’t in Incognito or Private browsing mode, as this can block the setup of a new passkey.
Bluetooth connectivity
Bluetooth must be turned on for both the device performing the action and the device holding the passkey. Passkeys use Bluetooth to verify that your devices are physically near each other.
For example, if you perform an action with your laptop, your laptop and your phone that holds the passkey must both have bluetooth turned on. Devices should be within the bluetooth range of 1-2 meters (3-7 feet) of each other. You don’t need to "pair" the devices in your settings. Turning on bluetooth allows them to recognize each other.
Email domain requirements
To enhance account security and minimize the impact of unauthorized access, Google Ads is updating its domain requirements for performing sensitive actions. Users accessing Google Ads via free domain email addresses like @gmail.com or @yahoo.com will be blocked from completing sensitive actions and must transition to a corporate email domain.
Learn more About email domain requirements for performing sensitive actions in Google Ads.
Set up a passkey for your Google Ads account
To set up a passkey, you need to sign in to your Google Account or verify your identity. To protect your account, don’t create a passkey on a shared device.
- Go to the Passkeys and security keys page in your Google Account settings. If you’re signed in to multiple Google accounts, make sure you’re accessing the settings for the account associated with your Google Ads account.
- Select Create a passkey.
- Create a passkey by following the steps provided by your device. These steps may include entering your PIN or scanning your biometric.
Check the passkey setup status for users in your account
To check the status of passkey setup for users in your account:
- Go to Access and security in the Admin
menu.
- Check the "Passkey status" column for details about each user in your account.
menu.To filter users in your account based on their passkey setup status:
- Go to Access and security in the Admin
- Select the Filter
icon.
- Select Passkey Status.
- Select Enabled or Disabled to filter by status.
To check the status of your entire account tree, select Show users in full hierarchy.
Enforce permanent passkey verification for sensitive actions
Account administrators can turn on phishing-resistant re-authentication to establish a permanent, mandatory security policy for their Google Ads account. Enabling this setting permanently locks passkey and hardware security key verification as the only accepted method of secondary verification for sensitive actions. After this setting is turned on, other secondary verification factors like SMS codes, email one-time passwords (OTP), or phone prompts are blocked entirely.
You can select an enforcement date, also known as the "Required as of" date, up to 30 days in the future. This provides a grace window for team members to register passkeys before sensitive actions are locked down.
How to turn on permanent passkey verification
- Select Account in the Admin menu.
- Select the Security tab.
- In the "Require passkeys for sensitive actions" section, select the toggle to switch it from "Off" to "On".
- Select the desired "Required as of" date. You can select a date up to 30 days from the current date.
- Read the irreversible terms and select Confirm.
After confirming, the toggle will lock in an active state and can't be modified.
Complete a sensitive action on a different device
If you need to complete a sensitive action on a different device than the one that holds your passkey, follow these steps.
- When you receive a "Confirm it’s you" challenge prompt, select Use another device or A different phone/tablet to use your passkey
- A QR code will appear on the screen. Use your phone’s camera to scan the code.
- Your phone will prompt you to verify using your screen lock, such as Face ID or your PIN.
- After you complete this prompt, your original device will automatically refresh and authorize the action.
- The "Confirm it's you" challenge allows you to use a Google passkey on your mobile device (Android or iPhone) to complete the challenge.
- You can also use a passkey stored on your mobile device (Android or iPhone) to complete the "Confirm it's you challenge". You don't need to create a separate passkey on the device you're currently using.
- If you have a physical security key, insert it while the QR code is displayed and follow the prompts to complete your verification.
Troubleshoot issues with passkeys
Use the troubleshooting steps below to fix any issues you may encounter setting up a passkey.
| Issue | Troubleshooting steps |
|---|---|
|
I can’t create a passkey on my device. |
Ensure your devices and browsers meet the Passkey setup requirements. |
|
I received the error message "Something went wrong" |
Ensure that your browser's updated to the latest available version. |
|
I received the error message "Passkey not found" |
This can be caused by removal of a passkey locally. You can resolve the issue by removing this passkey from your Google Account Security & sign-in settings. |
|
I no longer have access to the original device used to create my passkey |
Contact Google Support. |
|
I received the message "Your Admin hasn’t enabled passkeys for sign-in" |
This notification displays as a warning banner at the top of your Google Security page. This doesn’t mean that you can’t use a passkey. Under the notification, find and select Create a passkey. If you have a hardware security key, you can also select Use a security key and follow the instructions After you select your preferred method, you’ll receive a prompt like "Use Windows Hello" or "Touch ID". Follow the provided steps to complete validation. After you successfully complete the validation steps, your passkey will appear in the list and will be active for Google Ads, even if the notification banner remains visible. |
|
Passkey already exists |
You can receive a message that a passkey already exists for your account or device. Review the "Passkeys you created" section of the Passkeys and security keys page in your Google Account to identify any devices or passkeys you no longer own or use. If you’re on the correct device but the existing passkey isn't working, remove the current device's entry and select Create a passkey to fix your issue. |
|
I’m prompted to use the Google Authentication app to complete verification. |
If you’re prompted to complete verification using the Google Authentication app, you likely haven't enrolled in passkeys. Check your passkey setup status to verify if you’ve already successfully enrolled a passkey in your Google Ads account.
Ensure that "Skip password when possible" is toggled on. If you’re on a new device, create a local passkey for that specific hardware to stop generic authentication prompts. |
|
I've created a passkey, but the page keeps refreshing. |
If you recently created a passkey and the page refreshes or loops when you try to use it, this is expected. New passkeys take time to pair with Google Ads. New passkeys can take 24–48 hours to pair with Google Ads. During this period, you won't be able to take sensitive actions in the account. After 48 hours, you'll be able to complete sensitive actions in your Google Ads account using another authentication method. After 7 days, your passkey is fully active and ready to use for all sensitive actions in your Google Ads account. |
Frequently asked questions
General passkey information
Is the inability to share a passkey a technical limitation?You may be prompted to use your passkey specifically for sensitive actions within Google Ads. Sensitive actions include adding new users or changing billing information, among others. This ensures that sensitive changes are verified by a physical, unphishable credential.
You can still choose to use your standard password and 2-Step Verification (2SV) methods to log into your account.
Yes, you can change the default passkey settings. However, if this setting remains enabled, the system will automatically prompt you to create or use a passkey during your next login.
You can turn off the "Passkey-first" experience by turning off the Skip password when possible toggle.
- Sign in to your Google Account.
- Select Security from the left-hand navigation menu.
- Toggle the Skip password when possible switch to Off in the "How you sign in to Google" section.
Note that for Cloud and Workspace users, only the IT Admin has the authority to change the default passkey settings for the organization.
If your administrator has enabled passkeys for your account, they cannot be turned off. Refer to Enforce permanent passkey verification for sensitive actions for more information.