Google is tightening security across its ads ecosystem, requiring multi-factor authentication (MFA) for API users — a move that could impact how developers and advertisers access and manage accounts.