Google has launched passkeys for Google Merchant Center, rolling out starting October 29, 2026. Sensitive actions in your account will now need a passkey confirmation, which makes it much harder for a hacker to take over your account.
In this article, I’ll explain what passkeys are, how to set them up, the annoyances you can expect, and the extra steps I recommend to properly protect both your Merchant Center and Google Ads accounts.
What are passkeys in Google Merchant Center?
Passkeys are an extra layer of protection against bad actors. When you perform certain sensitive actions in Merchant Center, Google asks you to confirm with your passkey before the action goes through.
Examples of protected actions include (not confirmed):
- Adding new users to the account
- Deleting a feed
- Other sensitive account changes
Google hasn’t published the full list of protected actions yet, so expect to see the prompt on a few others too.
How you confirm depends on how you set up your passkey. Common options are:
- Your fingerprint on an Android device
- Windows Hello (Windows passkeys)
- Your browser’s built-in passkey manager
Good news if you already use passkeys in Google Ads: they automatically carry over to your Merchant Center account.
When does it start and how do you set it up?
The update starts on October 29, 2026. Google is sending an email to Merchant Center users asking them to set up a passkey.
- Open the email from Google titled along the lines of “Set up your passkey today”.
- Click Create passkey.
- Choose your method (fingerprint, Windows Hello or browser) and follow the prompts.
Don’t wait for the first time you need it. Set it up now so you’re not blocked in the middle of an urgent change.
Using multiple computers? Set up a passkey on each one
Passkeys are tied to the device and system you set them up on. If you log in to Merchant Center from a different computer, the passkey may not be available there.
This doesn’t lock anyone out of the account when they’re logged in. It means that on that specific device, you’ll need a passkey when you perform protected actions. My advice: set up passkeys on every device you use to log in to Google Merchant Center.
The downside, it can get annoying
I’ll be honest. If you’ve used passkeys in Google Ads, you know they can be frustrating. I sometimes have to enter my passkey two or three times just to create a simple campaign. And even after confirming, the campaign setup sometimes partially fails with a random error.
This is very common, and I believe it’s because Google rushed the feature out. They had good reason to, many Google Ads accounts have been hacked, with some spending 2 to 5 million US dollars in a single month. That’s devastating for any business.
So yes, it’s a bit of extra friction. But the protection is worth it.
Why Merchant Center security matters so much
Hacks are getting more sophisticated, and AI will only make them more convincing. A typical attack is an email that looks exactly like Google. You click the link, log in or fill out a form, and your access is stolen. Many merchants get caught out this way.
There have been fewer hacks on Merchant Center than on Google Ads, because Ads is more profitable for hackers. But when a Merchant Center account is hacked, the outcome is often worse:
- The hacker submits a different data feed.
- They remove you as a user and lock you out.
- Google flags the activity and suspends the account.
Getting that account approved again is extremely hard. I’ve seen many merchants in the Google Merchant Center Community struggle with this, and there’s little anyone can do. Google can’t verify you’re still the admin, because you’ve been removed. My guess is that these cases are rare enough that Google has no standard procedure for them. It can take months to get reinstated.
Never create a new account after a suspension
If your account is flagged for misrepresentation or suspended, do not set up a new Merchant Center account. Google treats that as circumventing a policy violation, which creates even bigger problems. You may then be unable to get approved at all, whatever you do to fix the original account.
Stick with your first account and keep working to resolve it, even if it takes half a year. I’m sorry that’s the reality, but it’s what I see happening.
Add two admins on two different domains
Passkeys are only one part of protecting your accounts. The other part is how your admin users are set up.
Google Ads
Add at least two admin users to your Google Ads account. Even if you’re a small business, use two of your own email addresses. With two admins, adding another admin requires verification by a second user. If you only have one admin, this protection isn’t enabled.
Make sure the two admin email addresses use two different domain names:
- Don’t: admin@example.com and info@example.com (same domain)
- Do: you@example.com and you@feedarmy.com (two different domains)
Never use free email addresses such as @gmail.com. You need to add the email domain as a verified domain in Google Ads. If you verify gmail.com, then in theory anyone with a Gmail address could add themselves to your account, for example through session hijacking. Only use hosted email addresses on domains you own and control.
Google Merchant Center
Merchant Center doesn’t have the two-admin verification system yet, but prepare for it now. Add two super admins on two different domains that you own:
- In Merchant Center, go to Users.
- Click the Manage business profile link below the users list.
- Add two super admin users, each on a different domain you own (no @gmail.com).
Yes, owning two domains and setting up hosted email costs extra money and time. Trust me, you’ll be glad you did it if someone ever gets into your account.
Your account protection checklist
- Create a passkey when Google’s email arrives (rollout from October 29, 2026)
- Set up a passkey on every device you use for Merchant Center
- Add two Google Ads admins on two different domains you own
- Add two Merchant Center super admins on two different domains you own
- Never use @gmail.com or other free email domains for admin users
- Be suspicious of emails that look like Google and ask you to log in
- If suspended, never open a new Merchant Center account