How-to · Updated October 11, 2026
Approve a sensitive Google Ads change (multi-party approval or passkey)
Updated October 11, 2026
10 minutes, plus 1 to 2 days (up to 7) for a new passkey
To approve a sensitive Google Ads change under multi-party approval, another Admin opens Admin, Access and security, selects Review request and clicks Approve or Deny within 20 days. Google Ads support cannot approve it for you. If Google asks for a passkey, create one days before you need it: new passkeys take time to pair.
Before you start
- A second person with Admin access. Google says any user with Admin access to the account, or an Admin of a linked manager account, can complete an approval.
- A device with a screen lock. Face ID, Touch ID or a PIN is needed if Google asks for a passkey.
- Bluetooth on both devices. Turn it on for your computer and your phone if the passkey lives on the phone.
Approve or deny the request
Any Admin other than the one who made the change approves it under Access and security, and must do so within 20 days or the request expires.
- Read the request in the Google Ads notifications bar, or in an email if one arrived: what action, and who started it.
- Click the Admin icon, then Access and security.
- In Pending invitations, select Review request. The Security requests tab lists the same requests by category.
- Select Approve if you recognize the person and the change. Select Deny if you do not, and tell the other Admins.
An approved change takes effect at once. A request left for 20 days expires as rejected, and the change must be started again.
Get your own change approved
Google says a second Admin must approve the request and Google Ads support cannot approve, deny or bypass it, so ask another Admin at your business directly.
- Tell another Admin what you changed. Google's page says in one place that it emails eligible Admins and in another that these emails are not sent, so do not rely on an email: ask them to check the notifications bar in Google Ads.
- To withdraw a request before anyone acts on it, open Admin, Access and security, and in Pending invitations select Revoke Request next to it. It works only on your own request, before anyone approves or denies it.
- If a request was denied or expired, make the change again to create a new request.
Google says multi-party approval pauses, canceling pending requests, when an account drops to a single Admin, and resumes when Admins are added.
Set up a passkey if Google asks for one
Create the passkey on the device you use for Google Ads before you need it, because Google says a new passkey can take 24 to 48 hours to pair with Google Ads.
- Sign in with the Google account you use for Google Ads and open the Passkeys and security keys page in your Google Account settings. Avoid shared devices and private windows.
- Select Create a passkey and follow your device's steps, such as entering your PIN or using your fingerprint.
- When a Confirm it's you prompt appears on a computer that does not hold the passkey, select Use another device, scan the QR code with your phone and unlock it. The computer then refreshes and allows the action.
Google says a passkey for this challenge is not the same as one used to sign in to your Google Account; setting up one does not set up the other. Autogenerated Android passkeys cannot verify sensitive actions at this time.
Check it worked
For an approval, the request shows Complete. Google says the Admin who started it is notified. If the request added a user, that user appears on the Users tab.
For a passkey: open Admin, Access and security and read the Passkey status column for your login. Google says a page that loops while a new passkey pairs is expected, and the passkey is fully active after 7 days.
Which changes need a second Admin or a passkey?
Google lists adding or removing a user, changing user roles and linking an existing account to a manager account, and says more actions may be added. Read-only roles and API users are exempt.
Separately, a Confirm it's you challenge may appear when you invite Standard or Admin users, make unusual budget or bulk changes, or create ads with a website domain not used in the account before. Turning off 2-Step Verification does not turn these challenges off.
Should an Admin require passkeys for everyone?
Some accounts can turn on Require passkeys for sensitive actions under Admin, Account, on the Security tab, with a Required as of date up to 30 days ahead. Google says the setting cannot be turned off by anyone once confirmed, and it then blocks text codes, email codes and phone prompts for sensitive actions.
Before turning it on, filter Access and security by Passkey Status and make sure every Admin shows Enabled. A passkey cannot be shared, so a login several people use must become separate logins first.
What if the device with the passkey is lost?
Google says to contact Google Support through its passkey troubleshooting form. It recommends a passkey on every device you use for Google Ads, which can keep one lost phone from blocking sensitive actions.