Thursday, June 25, 2026
As part of improving security for Google Ads accounts, the [Google Ads API](https://developers.google.com/google-ads/api?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-passkeys-june2026&utm_content=learnmore-api) will start requiring multi-party approvals when performing sensitive API actions. This is part of a broader change in Google Ads that requires [multi-party approvals to perform sensitive actions](https://support.google.com/google-ads/answer/16891189) in your Google Ads account. These important security updates will start rolling out starting on **July 27, 2026**, and will be enabled for all users over the next few weeks.
### What is changing?
When this change goes live, the following API calls will change their behavior.
**Inviting a user**
If you use the `CustomerUserAccessInvitationService.MutateCustomerUserAccessInvitation` method to [invite a new user](https://developers.google.com/google-ads/api/docs/account-management/managing-invitations.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-apidocs#invite-users) to manage a Google Ads account, the Google Ads API now evaluates whether multi-party approval may be necessary. In cases where our servers determine that a review is required, the system will pause the standard workflow and will not immediately generate a `CustomerUserAccessInvitation` or dispatch the invitation email. A `MultiPartyAuthReview` resource is initiated instead, with its [resource name](https://developers.google.com/google-ads/api/reference/rpc/v24/MutateCustomerUserAccessInvitationResult.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-refdocs#multi_party_auth_review) provided in the response. Once the pending review receives approval from a second account administrator, the `CustomerUserAccessInvitation` will be created and the invited user will receive their email. No new invites can be created for the user until the pending review is resolved.
**Updating or terminating a user's access**
If you use the `CustomerUserAccessService.MutateCustomerUserAccess` method to adjust a user's permissions using the [update operation](https://developers.google.com/google-ads/api/reference/rpc/v24/CustomerUserAccessOperation.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-refdocs#update) or revoke access using the [remove operation](https://developers.google.com/google-ads/api/reference/rpc/v24/CustomerUserAccessOperation.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-refdocs#remove), the Google Ads API now evaluates whether multi-party approval may be necessary. In cases where our servers determine that a review is required, the API generates a `MultiPartyAuthReview` resource in a pending state and returns its [resource name](https://developers.google.com/google-ads/api/reference/rpc/v24/MutateCustomerUserAccessInvitationResult.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-refdocs#multi_party_auth_review). Your requested modifications will remain pending and will only take effect once the multi-party review is successfully approved by a second account administrator. The `CustomerUserAccess` under review cannot be mutated until the pending review is resolved.
**How do I approve a multi-party approval request?**
You can fetch a pending `MultiPartyAuthReview` by using the `GoogleAdsService.Search` or `GoogleAdsService.SearchStream` methods, using the following GAQL query.
```
SELECT
multi_party_auth_review.resource_name,
multi_party_auth_review.multi_party_auth_review_id,
multi_party_auth_review.creation_date_time,
multi_party_auth_review.request_user_email,
multi_party_auth_review.operation_type,
multi_party_auth_review.justification,
multi_party_auth_review.target_resource,
multi_party_auth_review.customer_user_access_review.old_customer_user_access,
multi_party_auth_review.customer_user_access_review.new_customer_user_access,
multi_party_auth_review.customer_user_access_invitation_review.new_customer_user_access_invitation
FROM multi_party_auth_review
WHERE multi_party_auth_review.review_status = 'PENDING'
```
A pending `MultiPartyAuthReview` request can be approved or rejected using a `MultiPartyAuthReviewService.ResolveMultiPartyAuthReview` API request. The review needs to be done by a second administrator who did not create the original request. This can either be a human or a service account with administrator privileges. The pending review can be revoked by the original requestor.
**What do I need to do?**
If your application uses these methods, make sure to update it to handle [the multi-party approval workflows](https://developers.google.com/google-ads/api/docs/oauth/multi-party-approvals.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-apidocs) before **July 27, 2026** . We have added support for multi-party approvals to all the major versions of the API (v24.2, v23.3, v22.2 and v21.2). If you are using an official client library, make sure to [download their latest version](https://developers.google.com/google-ads/api/docs/client-libs.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-apidocs). You can refer to the following guides to learn more about these changes, which cover details on
- [Various states](https://developers.google.com/google-ads/api/docs/oauth/multi-party-approvals.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-apidocs#about-approval) of a multi-party approval request
- How to [retrieve](https://developers.google.com/google-ads/api/docs/oauth/multi-party-approvals.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-apidocs#retrieve-pending-requests) and [review](https://developers.google.com/google-ads/api/docs/oauth/multi-party-approvals.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-apidocs#review-requests) multi-party approval requests
- How to handle multi-party approval requests when [inviting users](https://developers.google.com/google-ads/api/docs/account-management/managing-invitations.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-apidocs#invite-users)
- How to handle multi-party approval requests when [updating user roles](https://developers.google.com/google-ads/api/docs/account-management/managing-users.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-apidocs#modify-user-roles) or [removing user access](https://developers.google.com/google-ads/api/docs/account-management/managing-users.md.txt?utm_source=googleblog-adsdevs&utm_medium=blog&utm_campaign=adr-adsapi-mpa-june2026&utm_content=learnmore-apidocs#remove-users)
For any questions or further discussion regarding this update, please connect with us on the ["Google Advertising and Measurement Community" Discord server](http://goo.gle/ads-and-measurement-discord). For technical support issues, reach out to
[](https://g.dev/anash) - [Anash P. Oommen](https://g.dev/anash), Google Ads API Team
**Labels:**
[authorization](https://developers.google.com/ads/blog/feeds/labels/authorization.md.txt),
[google-ads-api](https://developers.google.com/ads/blog/feeds/labels/google-ads-api.md.txt)