Google Merchant Center now wants a passkey for its riskiest changes. Take a roll call of everyone with access

What Google changed

If you sell through Google Shopping, Merchant Center is the account that decides whether your products show up at all. Google is now asking for a passkey before some of the riskiest changes in it.

According to Google's help page, Merchant Center users will need to confirm their identity with a passkey for sensitive actions such as changing the website or URL and managing admins and users. Google says the requirement is rolling out gradually, and each user gets an email and an in-product notice when it applies to them. Trade press reported Google's email to account owners saying it would start as soon as October 29, 2026. Normal sign-in stays the same.

A passkey is a sign-in credential stored on a device you own, unlocked with your fingerprint, face or PIN. A passkey can't be shared, which is the point, and also the problem if your account runs on a shared login. Google's page adds that it can't be guessed, copied or written down either. So before the next time someone needs to add a user in a hurry, take a roll call. Go down the list of everyone who touches the account and ask one question each: can this person still do what they need to do, from their own device?

The owner and the admins

Start at the top. The person who owns the account, and anyone with admin access, are the people most likely to hit the new prompt, because adding users and changing settings is their job.

Each of them needs a passkey on the device they actually use for Merchant Center. Google's requirements are broad: a computer on Windows 10, macOS Ventura or ChromeOS 109 or later, a phone on Android 9 or iOS 16 or later, or a FIDO2 hardware security key, plus a current browser. The device needs a screen lock. Google recommends setting up a passkey on every device you use, not just one.

Setting one up takes a few minutes. Google's help page sends you to the Passkeys and security keys page in your Google Account settings, where you choose Create a passkey and follow your device's prompts. One trap: if you're signed in to several Google accounts in the same browser, as many owners are, make sure you're on the account that's actually tied to Merchant Center. A passkey on your personal Gmail won't help with the store.

Two practical notes. Setup can fail in an incognito or private browser window, so use a normal one. And if you use your phone to approve an action on your laptop, Bluetooth has to be on for both, and they need to be within a meter or two of each other. That's fine at a desk and awkward for an owner approving changes from another city. If your owner travels a lot, a second admin with their own passkey is no longer a nice-to-have.

Staff and freelancers

Next, the people who do the daily work: your marketing coordinator, the virtual assistant who fixes disapproved products, the freelancer who set up your shipping settings. Many of them never need the sensitive actions and won't notice any change.

The ones who do need them are usually the ones working on a shared login, because someone once found it easier than adding them properly. That habit doesn't survive passkeys. Google says not to create a passkey on a shared device, and a passkey on the owner's phone doesn't help a freelancer on another continent. The fix is to give each person their own user with the access they need, which is what the account was built for. We've written about how shared vendor logins tend to linger long after the reason for them is gone.

Your agency and your tools

Agencies are where this kind of change has caused the most friction before. Google ran a similar passkey requirement in Google Ads earlier this year, and reporting at the time described agencies getting stuck when the person who needed to approve a change wasn't the person at the keyboard.

For Merchant Center, ask your agency three questions. Who on their team makes sensitive changes to your account? Does each of those people sign in as themselves rather than through a shared agency login? And who on your side approves when they can't?

It's also worth asking whether your agency already went through this with Google Ads. If it did, it probably has a process for who holds passkeys and how approvals are routed, and you can simply ask to use the same one for Merchant Center.

Then there are the tools: the feed app, the shopping channel in your store platform, the repricing service. Google's help page doesn't describe how the requirement affects feed uploads or connected apps, and we won't guess. What you can do is check that each connected tool is linked to a named person's account rather than an old employee's, so that if a tool ever needs to be reconnected, the person reconnecting it can complete the passkey step.

The people who left

Last on the list, and easiest to forget: everyone who used to work on the account. A passkey requirement doesn't remove a former contractor's access; it only makes certain changes harder for whoever holds it. Use this moment to remove the users who shouldn't be there. It's the same discipline as offboarding anyone's access, applied to one account that controls your sales.

Google gives you a way to see where things stand: the security page in your Merchant Center account shows each user's passkey setup status. Read it once with the roll call in hand. Anyone who should make sensitive changes and has no passkey gets a nudge this week. Anyone on the list who shouldn't be there gets removed while you still have an admin with a working passkey to do it.

The holiday season is when you least want a stuck approval. If you'd like help tidying up the people, tools and settings behind your store and its Google listings, our ecommerce team can help. Talk to us about your setup.

Related work: Spin Market.