Google has emailed Merchant Center account owners to say it will require passkey protection for sensitive account actions starting October 29, 2026. According to the email, quoted in full by Search Engine Watch, the requirement covers actions such as adding users and assigning permissions — while the regular sign-in process stays unchanged. Account owners will see an in-account notification when the requirement applies to them, and anyone who has already set up a Google passkey for another service, such as Google Ads, is covered automatically. Google’s message urges merchants to set up a passkey before the deadline to avoid being locked out of user and permission management.
What Changes on October 29
Starting as soon as October 29, Google will require passkey protection for certain actions inside Merchant Center. The email names adding users and assigning permissions as the sensitive actions covered. It does not say whether further actions will be added later.
The email is addressed to account owners and frames the change as account protection: set up a passkey today to avoid disruptions to managing users and permissions after the deadline.
What Stays the Same
The update does not change how merchants sign in to Merchant Center — that process is untouched. An in-account notification will tell account owners when the passkey requirement applies to them.
Merchants who already created a Google passkey for another service, such as Google Ads, do not need to create a new one: the same passkey automatically applies to their Merchant Center account. Search Engine Watch notes that the requirement applies only to the sensitive account actions, not to everyday use.
What the Email Leaves Open
The email says the requirement covers “certain actions” — “such as” adding users and assigning permissions. That wording leaves room for Google to extend the passkey requirement to more Merchant Center actions later, and account owners should read it as the start of a policy rather than a complete list.
The phrasing “starting as soon as October 29” and “when this requirement applies to you” also signals a rollout, not a single switch-flip: some accounts may see the requirement on the 29th itself, others later. The practical reading for merchants is to treat October 29 as the earliest date, not the only one, and to have passkeys in place before it. Google’s own instruction is the simplest version of the plan: set up a passkey today, and check the in-account notification for when the requirement lands on your account.
Why It Matters
Merchant Center accounts are a frequent target for takeover attacks because they feed product listings directly into Google’s shopping surfaces — a compromised account can rewrite prices, redirect listings or harvest buyer data. Requiring passkeys for user and permission management closes the specific door through which account hijackers most often walk in: adding a rogue user or escalating a compromised one.
The timing also fits a wider industry push to harden the accounts that touch money and customers. It lands in the same week that Microsoft Teams is adding AI-powered phishing detection to external chats and follows OpenAI’s disclosure of a remote-code-execution flaw in the Brotli compression library — a reminder that merchant infrastructure sits inside the same threat landscape as everyone else’s. Merchants who have delayed setting up passkeys now have a deadline attached to the delay.
Background
Google has been pushing passkeys across its products for years as the replacement for passwords, and Merchant Center is following a path Google Ads already walked: passkey support for Google services matured first, and Google’s own email explicitly tells merchants that a Google Ads passkey carries over automatically. The move continues Google’s steady tightening of merchant account security alongside its recent ads-policy and privacy changes, making October 29 the date on which password-only management of Merchant Center users ends.
0 Comments