Google is rolling out passkey checks in Merchant Center for website URL changes and user management, according to Google’s help page, with enforcement starting Oct. 29, per PPC News Feed.
If you sell on Google Shopping, Merchant Center is the account that decides whether your products show up at all. Everyone who touches it, whether that is you, a virtual assistant, an agency or a feed tool, can now be asked for a passkey on the riskiest changes. I’m covering it at Ecommerce Paradise because the failure mode is boring and expensive: you try to add a new VA or switch your store URL in a busy week and get stuck at a prompt nobody on your team can pass.
Below: exactly which actions are covered, what the earlier Google Ads passkey rollout taught agencies and store owners, and what I’d change before holiday traffic arrives. I covered the Google Ads version in Google Locks Your Ad Scripts Behind a Passkey, and the Merchant Center version follows the same pattern.
New passkey rules punish shared logins, so give every helper their own seat. Hire your next virtual assistant on OnlineJobs.ph and set them up with an individual login from day one. Hire a virtual assistant on OnlineJobs.ph →
Merchant Center Passkeys: Which Actions Now Need One
Google’s Merchant Center help page names two categories of sensitive action: website or URL changes, and admin or user management. For those actions, the page says you will be “required to use a passkey to confirm your identity.”
The start date comes from trade coverage rather than Google’s page. PPC News Feed, in a post dated Oct. 25, wrote that “starting October 29, Google Merchant Center will enforce passkeys for certain actions to enhance security,” and said the change will not affect sign-in methods. Search Engine Watch ran the same news under the headline “Google Merchant Center will require passkeys for select actions starting October 29.”
Google’s own page frames the rollout differently. It says the feature “will gradually be rolled out to all Merchant Center users” and that accounts which must use a passkey will get an email and an in-product notification. It gives no per-account schedule. Read together, the Oct. 29 date looks like the start of enforcement, not the day every account flips at once.
Google’s page also lists the practical requirements:
The device performing the action needs a screen lock such as Face ID, Touch ID or a PIN. Supported systems are Windows 10 or later, macOS Ventura or later, ChromeOS 109 or later, Android 9.0 or later, iOS 16 or later, or a FIDO2-capable hardware security key. Supported browsers are Chrome 109+, Safari 16+, Edge 109+ or Firefox 122+. Incognito or Private mode can block setup.
If your passkey lives on a phone and you are working on a computer, you scan a QR code shown on the computer, keep Bluetooth on for both devices and confirm with a fingerprint, face or PIN. Google says the two devices should be within 1 to 2 meters (3 to 7 feet) of each other. After the first pairing, the page says you get an automatic phone prompt to verify.
To create one, open the “Passkeys and security keys” page in the Google Account that is linked to Merchant Center, select “Create a passkey” and follow your device’s prompts. Google warns against creating a passkey on a shared device. If you lose the original device, the troubleshooting section sends you to Google Support or your IT administrator.
What the page does not say matters too. It does not describe what happens to a user who has no passkey beyond stating that one is required for the listed actions. It does not say whether free email domains are treated differently, and it does not mention feed uploads or running Shopping ads. Nothing in the sources reviewed says feeds or live ads stop working.
Google Ads Passkeys Set the Pattern, and Agencies Got Stuck
Merchant Center is the next Google advertising surface to get this treatment. The first was Google Ads, and its rollout shows where the friction shows up.
Search Engine Roundtable reported on June 5 that Google had added help documents titled “Use a passkey to complete sensitive actions” and “About the Security Agent for account hygiene,” and that passkeys would be required for sensitive actions starting July 15. On July 28, TechWyse reported that Google announced on July 27 that passkey verification would be required for all new OAuth 2.0 refresh token generation in the Google Ads API from Aug. 5. Existing refresh tokens keep working, according to TechWyse, and a new passkey can take up to seven days to become fully trusted.
Google’s Ads help page adds the details that matter for teams. All advertisers can set up a passkey, but the requirement applies only where it is enabled for the account. Under a pilot, users on free email domains such as gmail.com or yahoo.com are blocked from sensitive actions and must move to a corporate domain. Account administrators can also enforce passkeys permanently, and once confirmed that setting can’t be turned off.
The sharpest warning came from JumpFly on Sept. 10. The agency wrote that “Google Support can’t override this for you,” and described a client whose only other administrator had left the company. The client spent three weeks with Support without a fix, according to JumpFly, and the agency said it could have acted as the second approver as the linked managing agency. JumpFly’s advice: stop using free email for admin access, keep at least two individual company-domain admins, set up a passkey for each, and remove former employees and vendors.
Those are Google Ads rules, not Merchant Center rules. Google’s Merchant Center page does not mention a free-email block or a second-approver step. The counterpoint is a fair one: passkeys are phishing-resistant, they protect the account that controls where your product data points, and a solo owner with a phone or a laptop with a fingerprint reader will clear the prompt in seconds. The risk is concentrated in teams, not in one-person stores.
Why a Passkey Prompt Can Stall Your Shopping Feed Changes
My read: this will cost almost nobody anything on a normal day and will cost a few stores a lot on a bad one. The bad day is predictable. It’s the day you replatform, change domains, hand the account to a new agency or onboard a VA before a sale, and the person with the right to click the button can’t pass the prompt.
Google Shopping ads are the number one revenue driver I teach high-ticket stores to build around, so anything that gates changes to the account behind a device check is worth ten minutes of attention. If you changed your store setup recently, my notes on per-channel product titles in Shopify are a good place to confirm your feed is clean before you touch access.
Here is hypothetical math, not a reported figure. Take a store doing $60,000 a month with 40% coming from Google Shopping. That is $24,000 a month, or about $800 a day. If a URL fix or a new-user setup stalls for three days because nobody can complete the passkey step, roughly $2,400 of Shopping revenue is exposed in that window. Your numbers will differ, but the shape holds: a small admin chore sits in front of a large revenue line.
Three scenarios show where the thresholds are.
If you are the only user and you work from a laptop or phone with biometrics, set a passkey today and you are done. If you have one VA who shares your login, you have the real problem: a passkey is tied to a person and a device, Google tells you not to create one on a shared device, and a shared login is a security gap anyway. I’d move to one seat per person. If an agency or feed vendor manages the account, ask them now who their approving admin is, because the Google Ads story says Support will not rescue you when the only other admin has gone.
The security side is not hypothetical either. Store owners have been hit through the accounts and tools around the store, such as hijacked Shopify apps. Access to Merchant Center decides which URL your Shopping traffic lands on, and that is exactly the kind of control an attacker would want. I wrote about the staffing angle in vetting your VAs, and the same logic applies here: the fewer people with admin rights, the smaller the surface.
My advice is the same one I give clients about security infrastructure while scaling: treat access as part of the build, not an afterthought. If you would rather have the store build, the feed setup and the account structure handled by my team from the start, that is what the turnkey done-for-you service is for.
Passkeys, URL changes and user access are one more chore between you and a clean Shopping feed. Want my team to build and run your high-ticket store so that setup is handled? See the turnkey done-for-you service →
Set Up Merchant Center Passkeys Before Q4 Peak
Do these five things this week, in this order, while nothing is on fire:
- List every user on your Merchant Center account and remove anyone who no longer needs access, including old agencies, former VAs and feed vendors. If the account owner is a person who has left your business, fix that first, because in the Google Ads case JumpFly described, Support could not fix it for the client.
- Create your own passkey today in the Google Account that is linked to Merchant Center, using the “Passkeys and security keys” page. Do it on a device you control with a screen lock, outside Incognito, and keep Bluetooth on. Google’s Ads documentation says a new passkey can take one to two days to pair, so do not wait until the day you need it.
- Give each admin an individual company-domain login. If you run on Gmail addresses, set up branded email through Google Workspace and move admin access there. If your domain needs work first, Namecheap is where I’d register one.
- Do planned URL changes and new-user setups now, not the week of a sale. If you are about to relaunch on Shopify, check your setup against Shopify and the channel settings first, then make the Merchant Center change while you have time to troubleshoot. Retailers like Walmart are already splitting Black Friday into three events starting Nov. 12, so your window is shorter than it looks.
- Write the access steps into a one-page SOP: who is the admin, who is the backup admin, where recovery steps live, and how a new VA gets a seat. Store the details in a password manager. If you are unsure how your setup holds up, Explore Turnkey Builds.
If you are still hiring, pay overseas helpers through a multi-currency account such as Wise and give each one an individual login on day one. My piece on AI-ready SOPs shows how to write the access steps so a new person can follow them without calling you.
Frequently Asked Questions
Does this change how I sign in to Merchant Center?
No. PPC News Feed reported that sign-in methods are not affected. The passkey is required to confirm your identity for the listed sensitive actions.
Which Merchant Center actions need a passkey?
Google’s help page lists website or URL changes and admin or user management. It does not publish a longer list, so check the page again before relying on it for other actions.
What happens if I don’t have a passkey?
Google’s page says a passkey is required for those actions and does not describe a workaround. If you are prompted for Google Authenticator verification, the page says you likely haven’t enrolled one.
Can my VA use a phone passkey on a computer?
Yes, according to Google’s page. They scan a QR code on the computer with a supported phone, keep Bluetooth on for both devices and confirm with a fingerprint, face or PIN. Each person needs their own passkey, not a shared one.
Is account access really a security issue for a small store?
Yes. The ASOS breach hit the retailer’s customer messaging platforms, which shows how connected tools widen exposure.
Will my Shopping ads or product feed stop working?
Nothing in Google’s page or the trade coverage says so. The change gates the listed account actions. Still, a stalled URL or user change can hold up work, so handle it before peak season, and see my note on the latest Merchant API additions if you manage feeds through the API.
Is a high-ticket store with one owner affected?
Yes, but lightly: set one passkey and you are done. The pain lands on stores with VAs, agencies and shared logins. If you are still choosing a product line for your store, start with my high-ticket niches list. The free version lives at ecommerceparadise.com/niches.
Have a Merchant Center access question you don’t want to guess on? Bring it to other store owners and me inside the community, starting with the 7-day free trial (paid after that). Join the Skool community →
Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.
Related Articles
If this was useful, these go deeper:
- Google Locks Your Ad Scripts Behind a Passkey Aug. 5
- One Week Left: Google Kills the Content API for Shopping
- Shopify Asks App Developers to Harden After Hijacks
- High-Ticket Dropshipping: What It Is and How to Start (2026 Guide)
- Dropshipping Marketing Strategy in 2026: A Step-by-Step Playbook for High-Ticket Stores
Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.
He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.
