As part of improving security for Google Ads accounts, the Google Ads API will start requiring Multi-factor authentication (MFA) for Google Ads API users. These important security updates will start rolling out from April 21, 2026 , and will be enabled for all users over the next few weeks.
What is MFA?
MFA, also known as 2-step verification or 2SV, is an important security measure. In addition to your password, MFA requires another proof of identity, known as an authentication factor, to successfully sign in to an account. By requiring the second factor, you’re making it significantly harder for unauthorized users to breach your account, and a compromised password alone is not enough to gain access.
What is changing?
Once this change goes live, users following the user authentication workflow to generate new OAuth 2.0 refresh tokens for Google Ads API will always be challenged with a second factor for authentication in addition to a username and password.
If you don’t have 2-step verification enabled, you will be prompted to add a 2-step verification method.
What action do I need to take?
You may be affected by this change, depending on the authentication workflow that your application uses.
Service account workflow User authentication workflow
Existing OAuth refresh tokens are not affected by this change. They will continue to work as usual, and you won’t be prompted for reauthorization when obtaining OAuth access tokens.
New users will be challenged with a second factor for authentication in addition to a username and password.
What other platforms are affected by this change?
If you use Google Ads Editor , Google Ads Scripts , BigQuery Data Transfer Service or Data Studio to manage Google Ads, you will start getting challenged with a second factor for authentication in addition to a username and password. If you don’t have 2-step verification enabled, you will be prompted to add a 2-step verification method.
How can users check and enable MFA?
Users can check whether MFA is enabled for their account by opening the Security tab of their Google Account settings page . The 2-Step Verification setting is displayed in the How you sign in to Google section. If MFA isn’t enabled, follow the on-screen steps displayed in this section.
If you don't see the 2-Step Verification option for your account, your administrator might have disabled it. Contact your administrator for assistance.
Troubleshooting
Q: When I navigate to the Google Account settings page , I don’t see the 2-Step Verification option for my account.
A: If you don't see the 2-Step Verification option for your account, your administrator might have disabled it. Contact your administrator for assistance.
Q: I don’t have a 2-step verification option enabled for my account. When I attempt to sign in, I get an error that "Google couldn’t verify this account belongs to you." and I am prompted to Recover account instead of prompting me to add a 2-step verification .
A: In certain situations, Google needs additional verification before letting you add a second factor to your account. To fix the issue, navigate to the Security tab of your Google Account settings page . The 2-Step Verification setting is displayed in the How you sign in to Google section. If 2-Step Verification isn’t enabled, follow the on-screen steps displayed in this section. Wait for a few minutes and attempt signing into the Google Ads API application again.
For any questions or further discussion regarding this update, please connect with us on the "Google Advertising and Measurement Community" Discord server .
Anash P. Oommen , Google Ads API Team
