Google Analytics 4
Connect Google Analytics 4 to run analytics reports, view realtime data, explore audiences, and manage properties.
You end up with two values from one Google Cloud OAuth client, the Client ID (…apps.googleusercontent.com) and the Client secret (GOCSPX-…), which you paste into PopMCP's OAuth Client ID and OAuth Client Secret fields.
- Setup time
- 12 min
- Auth
- OAuth authorization
- API base URL
- https://analyticsdata.googleapis.com/v1beta
- Rate limits
- Standard (free) GA4 properties get 200,000 Data API core tokens per property per day, 40,000 per hour, and at most 10 concurrent requests.
Before you begin
- A Google account with at least Viewer access on the GA4 property you want to read
- A Google Cloud project you can edit. The free tier is fine, because the Analytics APIs cost nothing
- The PopMCP callback URL, copied from the connector screen before you start
- Editor or Owner on the Cloud project, so you can enable APIs and create OAuth clients
Get your credentials
Pick or create a Google Cloud project
Open the Google Cloud console and click the project picker in the top bar. Select an existing project, or click New project and name it popmcp-analytics.
Enable both Analytics APIs
Go to APIs & Services → Library, search for Google Analytics Data API and click Enable. Return to the library and do the same for the Google Analytics Admin API.
Google Analytics Data API
Accesses report data in Google Analytics.
- Type
- APIs & services
- Last updated
- Aug 12, 2026
- Category
- Analytics, Google Enterprise APIs
- Service name
- analyticsdata.googleapis.com
| API | Status | Requests (30d) |
|---|---|---|
| Google Analytics Data API | Not enabled | 0 |
| Google Analytics Admin API | Not enabled | 0 |
Both APIs must be enabled on the same project that will own the OAuth client.
Fill in Branding, then publish the app
Open Google Auth Platform → Branding and enter the App name and User support email. Open Audience, set User type to External, and click Publish app.
Audience
Choose who can access your app and manage your test users.
- User type
- External
- Publishing status
- Testing
- Test users
- 1 of 100
Publishing needs no Google review. It adds a one-time unverified-app screen where you click Advanced and continue.
Create a Web application OAuth client
Go to Google Auth Platform → Clients and click Create client. Set Application type to Web application, name it PopMCP, then click Add URI under Authorized redirect URIs and paste the callback URL copied from PopMCP.
Create OAuth client ID
A client ID is used to identify a single app to Google's OAuth servers.
Google matches the redirect URI character for character, including any trailing slash.
Copy the Client ID and secret into PopMCP
Copy both values from the OAuth client created dialog before you close it. Paste them into PopMCP's OAuth Client ID and OAuth Client Secret fields, click Connect, and pick the Google account with access to your GA4 property.
Clients
OAuth clients that can request tokens for this project.
| Name | Type | Client ID | Status | Creation date |
|---|---|---|---|---|
| PopMCPWeb application | Web application | 418***-a7f2q**** | Enabled | Mar 4, 2026 |
Google stores only a hash of the secret. Once this dialog closes it shows the last four characters and nothing more.
Connect in PopMCP
Open your workspace, choose Google Analytics 4 in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| OAuth Client IDtext | From your Google Cloud project → APIs & Services → Credentials → OAuth client. Make sure the Google Analytics Admin API and Analytics Data API are enabled for that project first (APIs & Services → Library). |
| OAuth Client Secretsecret | Stored encrypted; used server-side only and never shown again.Encrypted with AES-256-GCM on save and never shown again. |
https://app.popmcp.com/api/providers/google/callbackPopMCP verifies the credential against Google Analytics 4 immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Google Analytics 4 at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| https://www.googleapis.com/auth/analytics.readonly | Every report, realtime query, metadata lookup and property listing PopMCP performs. |
| https://www.googleapis.com/auth/analytics.edit | Only needed for the write-side Admin API tools such as creating custom dimensions, key events, audiences or data streams. Drop it if you want a read-only connection. |
Verify it worked
PopMCP lists your GA4 properties by name after the consent screen, and asking for last week's sessions by channel returns numbers that match the Google Analytics UI.
Troubleshooting
Error 400: redirect_uri_mismatch
Why: The Authorized redirect URI on the OAuth client is not byte-identical to the callback PopMCP sends.
Fix: Copy the callback straight out of PopMCP, paste it into Google Auth Platform → Clients → your client → Authorized redirect URIs, save, and retry. Changes can take a few minutes to propagate.
The connection works for a week, then fails with invalid_grant
Why: The OAuth app is still in Testing, so Google expires its refresh tokens after exactly 7 days.
Fix: Google Auth Platform → Audience → Publish app, then reconnect once in PopMCP to mint a fresh refresh token.
403 accessNotConfigured or SERVICE_DISABLED
Why: The Analytics Data API or the Analytics Admin API was never enabled on the project that owns this client.
Fix: APIs & Services → Library, enable both Google Analytics Data API and Google Analytics Admin API on the same project, then retry.
Connected, but no properties are listed
Why: The Google account you consented with has no GA4 access, or you picked the wrong account at the chooser.
Fix: Give that account at least Viewer on the property in GA4 Admin → Property access management, then disconnect and reconnect.
429 RESOURCE_EXHAUSTED on big date ranges
Why: Wide reports burn core tokens fast on standard properties.
Fix: Narrow the date range or the number of dimensions, or spread requests out. The hourly bucket refills every hour.