Google Search Console
Connect Google Search Console to review search analytics, inspect pages, manage sitemaps, and track query performance.
You end up with two values from one Google Cloud OAuth client, the Client ID (…apps.googleusercontent.com) and the Client secret (GOCSPX-…), which you paste into PopMCP's OAuth Client ID and OAuth Client Secret fields.
- Setup time
- 10 min
- Auth
- OAuth authorization
- API base URL
- https://searchconsole.googleapis.com/webmasters/v3
- Rate limits
- Search Analytics allows 1,200 queries per minute per site and 1,200 per minute per user, with 30,000,000 queries per day per Cloud project.
Before you begin
- A Google account that is a verified owner or a delegated user on the Search Console property
- A Google Cloud project you can edit. The Search Console API is free
- The PopMCP callback URL, copied from the connector screen before you start
- Editor or Owner on the Cloud project, so you can enable APIs and create OAuth clients
Get your credentials
Enable the Google Search Console API
Pick your project in the project picker in the top bar, then go to APIs & Services → Library. Search for Google Search Console API and click Enable.
Google Search Console API
View Google Search Console data for your verified sites.
- Type
- APIs & services
- Provider
- Google Enterprise API
- Category
- Google Enterprise APIs, Marketing
- Service name
- searchconsole.googleapis.com
One API covers Search Analytics, Sites, Sitemaps and URL Inspection. There is no second API to turn on.
Fill in Branding, then publish the app
Open Google Auth Platform → Branding and enter the App name and User support email. Open Audience, set User type to External, and click Publish app.
Audience
Choose who can access your app and manage your test users.
- User type
- External
- Publishing status
- Testing
- Test users
- 1 of 100
Under Data access you can add the webmasters scope so the consent screen names it explicitly.
Create a Web application OAuth client
Go to Google Auth Platform → Clients and click Create client. Choose Application type → Web application, name it PopMCP, then click Add URI under Authorized redirect URIs and paste the callback URL copied from PopMCP.
Create OAuth client ID
A client ID is used to identify a single app to Google's OAuth servers.
Google Auth Platform replaced the old APIs & Services → Credentials → OAuth consent screen pages. The client list is the same object.
Copy the Client ID and secret into PopMCP
Copy both values from the OAuth client created dialog before you close it. Paste them into PopMCP's OAuth Client ID and OAuth Client Secret fields, click Connect, and choose the Google account that owns your Search Console property.
Clients
OAuth clients that can request tokens for this project.
| Name | Type | Client ID | Status | Creation date |
|---|---|---|---|---|
| PopMCPWeb application | Web application | 418***-k3m9d**** | Enabled | Mar 4, 2026 |
If the dialog is gone, open the client and click Add secret to mint a new one.
Connect in PopMCP
Open your workspace, choose Google Search Console in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| OAuth Client IDtext | From your Google Cloud project → APIs & Services → Credentials → OAuth client. Make sure the Search Console API is enabled for that project first (APIs & Services → Library). |
| OAuth Client Secretsecret | Stored encrypted; used server-side only and never shown again.Encrypted with AES-256-GCM on save and never shown again. |
https://app.popmcp.com/api/providers/google/callbackPopMCP verifies the credential against Google Search Console immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Google Search Console at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| https://www.googleapis.com/auth/webmasters | Full read and write access: search analytics queries, URL inspection, listing sites, and submitting or deleting sitemaps. The read-only variant webmasters.readonly would block sitemap submission, so PopMCP asks for the full scope. |
Verify it worked
After consenting, PopMCP lists your verified Search Console properties, and a query for last month's top queries returns the same clicks and impressions you see in the Performance report.
Troubleshooting
Error 400: redirect_uri_mismatch
Why: The Authorized redirect URI on the client differs from the callback PopMCP sends, often by a trailing slash or http versus https.
Fix: Copy the callback out of PopMCP and paste it into Google Auth Platform → Clients → your client → Authorized redirect URIs, save, wait a minute, then retry.
invalid_grant about a week after connecting
Why: The OAuth app was left in Testing, so Google expired the refresh token after 7 days.
Fix: Google Auth Platform → Audience → Publish app, then reconnect once in PopMCP. Publishing needs no Google review and only adds a one-time unverified-app screen.
403 User does not have sufficient permission for site
Why: The Google account you consented with is not a verified owner or user of that property.
Fix: In Search Console → Settings → Users and permissions, add that account with Full or Owner for sitemap writes, then reconnect.
Property list is empty, or a domain property is missing
Why: Domain properties are addressed as sc-domain:example.com and only appear if that exact property is verified for the account.
Fix: Verify the domain property in Search Console, or connect using the URL-prefix property you already own.
429 or quota exceeded during bulk query pulls
Why: Search Analytics is capped at 1,200 queries per minute per site and per user.
Fix: Batch fewer date ranges at once and let PopMCP back off. The per-minute bucket resets on its own.