Google Data Studio
Connect Google Data Studio to find reports and data sources, audit and change who can open them, and build new reports from your templates.
You end up pasting the OAuth Client ID and Client Secret of an Internal Web application client from a Google Cloud project with the Data Studio API turned on, after a Google Workspace super admin has authorized that Client ID for the Data Studio scopes under domain-wide delegation.
Paid plan required before this connector works
Google opens the Data Studio API only to Google Workspace or Cloud Identity accounts, after a super admin authorizes the app once. Personal Gmail accounts cannot use it.
- Typical wait
- None from Google. The admin step takes a minute, and Google says it can take up to 24 hours to apply
- Cost
- The API is free. It needs a Google Workspace subscription or Cloud Identity, whose Free edition costs nothing.
- Blocked until approved
- Everything. Until a super admin authorizes the app, Google refuses the sign-in with Error 400: invalid_scope, and a personal account cannot be authorized at all.
- Works meanwhile
- Create the Google Cloud project, turn on the Data Studio API and make the Internal OAuth client, then send its Client ID to your admin.
Where to apply: No form. A super admin opens admin.google.com, Security, Access and data control, API controls, Manage Domain Wide Delegation, Add new, enters the Client ID, adds the OAuth scopes https://www.googleapis.com/auth/datastudio, https://www.googleapis.com/auth/datastudio.readonly and https://www.googleapis.com/auth/userinfo.email, and clicks Authorize.
- Every scope the app asks for has to be on the admin's list: a Client ID authorized for datastudio.readonly alone fails a sign-in that asks for datastudio.
- Reports a personal Gmail account owns are reachable only after they are shared with a Workspace account.
- Google's API covers finding reports and data sources and their sharing. It cannot read a report's charts or data, or create, copy or delete reports.
- Google renamed Looker Studio back to Data Studio in April 2026, so the console, Google's docs and the app may show either name.
- Setup time
- 10 min
- Auth
- OAuth authorization
- API base URL
- https://datastudio.googleapis.com/v1
- Rate limits
- Google publishes no request limit for the Data Studio API. Your project's own numbers are in the Cloud console under IAM & Admin → Quotas. One search returns up to 1,000 reports or data sources.
Before you begin
- A Google Workspace or Cloud Identity account. Google opens the Data Studio API (now named Data Studio API) only to accounts that belong to such an organization; personal gmail.com accounts cannot use it
- A super administrator of that Workspace organization for one step in the Admin console, or the role yourself
- A Google Cloud project in your organization where you can turn on APIs and create OAuth clients (Owner or Editor). The API is free
- The PopMCP callback URL, copied from the Google Data Studio connect form before you start
- Data Studio was renamed Data Studio in April 2026: the console, Google's docs and the app may show either name
Get your credentials
Turn on the Data Studio API
Pick or create a project of your Workspace organization in the top bar, then open APIs & Services → Library. Search for Data Studio API (older consoles list it as Data Studio API; the service name is datastudio.googleapis.com), open its card and click Enable.
Data Studio API
Search for and manage Data Studio assets.
- Service name
- datastudio.googleapis.com
- Project
- acme-reporting
- Status
- Not enabled
Turn it on in the same project that will own the OAuth client.
Set up Google Auth Platform with an Internal audience
Open Google Auth Platform → Branding. If it says Google Auth platform not configured yet, click Get Started. Enter an App name and a User support email, choose Internal under Audience, add an Email address under Contact Information, agree to the user data policy, then click Continue and Create. Do not add the Data Studio scopes on Data access: your admin authorizes them in the Admin console instead.
Audience
Choose who can authorize this app to access their account data.
An Internal app needs no review from Google and has no 7 day Testing expiry. Only accounts in your organization can sign in with it, which is all the Data Studio API allows anyway.
Create a Web application OAuth client
Open Google Auth Platform → Clients and click Create client. Set Application type to Web application, name it PopMCP Data Studio, click Add URI under Authorized redirect URIs, paste the callback URL from the PopMCP connect form exactly as shown, and click Create.
Create OAuth client ID
A client ID identifies a single app to Google's OAuth servers.
Leave Authorized JavaScript origins empty. Google matches the redirect URI character for character.
Copy the Client ID and Client Secret
Copy the Client ID and Client secret from the OAuth client created dialog before you close it. If the dialog is already gone, open the client from Clients and click Add secret to make a new one. Your admin needs the Client ID in the next step.
Clients
After this dialog closes the console shows only the last four characters of the secret.
Have a Workspace super admin authorize the Client ID
A super administrator opens the Google Admin console at admin.google.com → Security → Access and data control → API controls → Manage Domain Wide Delegation and clicks Add new. They enter your Client ID, add each of these under OAuth Scopes: https://www.googleapis.com/auth/datastudio, https://www.googleapis.com/auth/datastudio.readonly and https://www.googleapis.com/auth/userinfo.email (the connect form has them ready to copy), then click Authorize. Google says this can take up to 24 hours, though it is usually quicker.
Domain-wide delegation
Developers can register their web applications and other API clients with Google to enable access to data in Google services.
Without this step Google refuses the sign-in with Error 400: invalid_scope. Once it is done, people in your organization see no consent screen at all.
Paste the values into PopMCP and sign in with Google
On PopMCP's Google Data Studio connect form, paste the values into OAuth Client ID and OAuth Client Secret and click Sign in with Google. Choose your work account. Google signs you in without a consent screen when the admin step is done, and PopMCP connects as that account.
Connect in PopMCP
Open your workspace, choose Google Data Studio in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| OAuth Client IDtext | In Google Cloud Console, in a project of your Workspace organization: turn on the Data Studio API (APIs & Services → Library), set Google Auth Platform → Audience to Internal, then Clients → Create client → Web application with the callback URL above under Authorized redirect URIs. |
| OAuth Client Secretsecret | Shown when you create the client. Stored encrypted and used server-side only.Encrypted with AES-256-GCM on save and never shown again. |
| Scopes your Workspace super admin authorizespreset | Before you sign in, a Google Workspace super admin adds your Client ID with these scopes: Admin console → Security → Access and data control → API controls → Manage Domain Wide Delegation → Add new. Until then Google shows "Error 400: invalid_scope" (it can take up to 24 hours to apply). Personal Gmail accounts cannot use Data Studio's API. |
https://app.popmcp.com/api/providers/google/callbackPopMCP verifies the credential against Google Data Studio immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Google Data Studio at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| https://www.googleapis.com/auth/datastudio | Searches reports and data sources and changes who can open them (share, unshare, link sharing). The scope PopMCP asks for when you connect with your own app. |
| https://www.googleapis.com/auth/userinfo.email | Reads the email of the account that signed in, so the connection is named after it and the sharing audit knows which email domain is yours. Data Studio's API has no call that says who you are. |
Verify it worked
After you sign in PopMCP shows Connected under your work email. Ask the AI to list your Data Studio reports and their titles and links come back.
Troubleshooting
Google shows Error 400: invalid_scope
Why: Your organization has not authorized this Client ID for the Data Studio scopes, or authorized a different Client ID or fewer scopes. Google refuses every app a Workspace admin has not authorized.
Fix: Ask a super admin to add the exact Client ID with all three scopes under Security, Access and data control, API controls, Manage Domain Wide Delegation, then try again. It can take up to 24 hours to apply.
"This is a personal Google account" when connecting
Why: You signed in with a gmail.com account. Google opens the Data Studio API only to Google Workspace and Cloud Identity accounts.
Fix: Sign in with your work account. To reach reports a personal account owns, share them with your work account first.
Access blocked: the app can only be used within its organization
Why: The OAuth app is Internal and you signed in with an account from another organization.
Fix: Sign in with an account of the organization that owns the Google Cloud project, or create the client in a project of your own organization.
Error 400: redirect_uri_mismatch
Why: The Authorized redirect URI on the client does not exactly match the callback URL PopMCP sends, usually a trailing slash or http instead of https.
Fix: Open the client under Google Auth Platform → Clients and paste the callback URL straight from the PopMCP connect form. Changes can take a few minutes to apply.
403 saying the Data Studio API has not been used in the project or is disabled
Why: The API is not turned on in the project that owns the OAuth client.
Fix: Turn on the Data Studio API in APIs & Services → Library on that same project, wait a minute, then retry.
A sharing change is refused because the connection can read only
Why: Google granted only datastudio.readonly, usually because the admin authorized just that scope, or the connection is read-only in PopMCP.
Fix: Have the admin add https://www.googleapis.com/auth/datastudio to the Client ID and reconnect, and allow write actions on the connection in PopMCP.
Reference
Google Search Console
Connect Google Search Console to review search analytics, inspect pages, manage sitemaps, and track query performance. MCP setup for Claude and ChatGPT.
Google Tag Manager
Connect Google Tag Manager to Claude, ChatGPT and other MCP clients with PopMCP. Step-by-step OAuth app setup, plus fixes for common errors.