Google will begin rolling out mandatory MFA for the Google Ads API on April 21, requiring users to verify their identity with a second factor when generating new OAuth 2.0 refresh tokens, with full enforcement expected over the following weeks. Existing refresh tokens will continue working without interruption, but new authentications will require MFA by default, and the requirement extends beyond the API to tools including Google Ads Editor, Scripts, BigQuery Data Transfer, and Data Studio. Service account workflows used for automated or offline use cases are not affected by the change.
