Google Merchant Center Now Requires Passkeys for Admin Actions: What Ecommerce Brands Must Set Up Before BFCM

On October 29, 2026, Google Merchant Center began requiring Passkey authentication for high-security administrative actions, affecting all ecommerce brands that manage user access, change account roles, or update admin permissions. For brands running Google Shopping, Performance Max, or Search campaigns, this means any new user added to your Merchant Center account now triggers a passkey verification step, and brands without a configured passkey will be locked out of administrative functions during one of the most critical periods of the year.

What Does Google Merchant Center's Passkey Requirement Mean for Your Campaigns?

Passkeys replace traditional password-based admin authentication for sensitive Merchant Center actions. If your account owner has not configured a Google Passkey, you cannot add new users, change roles, or manage permissions, which means any last-minute team or agency access changes before BFCM are blocked. Brands with a Google Passkey already set up for their Google Account will find it automatically applies to Merchant Center as well.

For a deeper look at Google's ongoing platform changes, see our full Google Ads 2026 update tracker.

What Is Google Passkey and Why Did It Change for Merchant Center?

A Passkey is a phishing-resistant authentication credential stored on your device, replacing passwords for high-risk account actions. Google began rolling out Passkey support across its ad products in 2025, and the October 29, 2026, Merchant Center rollout extends mandatory Passkey protection specifically to admin-level actions: adding or removing users, adjusting permissions, and modifying account settings. Google confirmed the change is designed to reduce unauthorized account takeovers, which have been a growing problem as ad spend volumes increase. Brands managing multiple Merchant Center accounts through an MCA (Multi-Client Account) must ensure each sub-account owner has completed Passkey setup independently.

Which Merchant Center Actions Now Require a Passkey?

The following actions now require an active Passkey to complete inside Google Merchant Center as of October 29, 2026:

• Adding new users to any Merchant Center account or sub-account
• Changing user roles (for example, from Standard access to Admin)
• Removing existing users from the account
• Linking or unlinking Google Ads accounts
• Modifying account-level settings such as shipping, tax, or returns policies

Routine actions like updating product feeds, adjusting prices, or managing promotions are not affected and continue to work without Passkey authentication.

How Does This Affect Ecommerce Brands Managing Agencies or Teams Before BFCM?

Any brand that was planning to add agency access, grant permissions to a new team member, or restructure account roles before Black Friday must complete Passkey setup first. With BFCM 2026 less than 4 weeks away, the window to resolve access issues without disrupting campaigns is narrow. Agencies managing multiple client accounts face the highest risk: if a client account owner has not set up a Passkey and needs to grant new access, that process is now blocked until they do. CTC recommends auditing every Merchant Center account in your portfolio immediately and verifying Passkey setup is complete before November 1.

What Should You Do Now with Google's Passkey Requirement?

1. Log into Google Merchant Center and check Passkey status today (Settings, then Account, then Security). If no Passkey is configured, set one up now using your Google Account security settings.
2. Audit all users on every Merchant Center account you manage. Confirm the account owner for each sub-account has Passkey enabled, especially if you operate through a Multi-Client Account.
3. Complete any pending user additions or role changes before November 1. Every access change after October 29 requires Passkey authentication, so do not wait until the week of Black Friday.
4. Alert your agency partners and internal team leads to the new requirement. If your agency needs access and is waiting on a client-side admin to set up Passkey, that conversation needs to happen this week.
5. Document your account structure now. Create a quick audit of who has access to which accounts, what role they hold, and whether Passkey is active. This will prevent emergency scrambles in November.

Frequently Asked Questions

Related Reading

• Every Google Ads Change in 2026 (Updated Weekly)
• Google Smart Bidding Exploration Is Now Live for Retail PMax: What Ecommerce Brands Must Enable Before BFCM
• CTC Google Ads Management for 7-9 Figure Ecommerce Brands

Questions about securing your Google account access before Q4 or optimizing your Merchant Center setup for BFCM? Talk to the CTC team and we'll help you get audit-ready before Black Friday.