Google Tag Manager
Connect Google Tag Manager to Claude, ChatGPT and other MCP clients with PopMCP. Step-by-step OAuth app setup, plus fixes for common errors.
You end up pasting the OAuth Client ID and Client Secret of a Web application client from a Google Cloud project with the Tag Manager API enabled, then choosing which Tag Manager account the connection works in.
- Setup time
- 10 min
- Auth
- OAuth authorization
- API base URL
- https://tagmanager.googleapis.com/tagmanager/v2
- Rate limits
- 10,000 requests per day and 0.25 requests per second (25 per 100 seconds) per Cloud project, not per user, enforced on a 100-second window. A per-user setting above that does not raise the project cap. Daily quotas reset at midnight Pacific time, and going over returns 403.
Before you begin
- A Google account with access to the Tag Manager account. Reading needs Read on a container, editing needs Edit, creating versions needs Approve, publishing needs Publish, and managing users needs the account's Administrator role
- A Google Cloud project you own, with Owner or Editor so you can enable APIs and create OAuth clients. The Tag Manager API itself is free
- Ideally a project used only for this connection: Google allows 25 Tag Manager API requests per 100 seconds and 10,000 a day per Cloud project, shared by everything that uses it
- The PopMCP callback URL, copied from the Google Tag Manager connect form before you start
- Personal gmail.com accounts can only use the External audience. Internal needs a Google Workspace organisation
Get your credentials
Enable the Tag Manager API
Pick or create a project in the top bar, then open APIs & Services → Library. Search for Tag Manager API, open its card and click Enable.
Tag Manager API
This API allows clients to access and modify container and tag configuration.
- Service name
- tagmanager.googleapis.com
- Project
- acme-gtm-mcp
- Status
- Not enabled
The quota of 25 requests per 100 seconds belongs to this project, so keep other tools off it if you can.
Fill in the Google Auth Platform branding
Open Google Auth Platform → Branding. If it says Google Auth platform not configured yet, click Get Started. Enter an App name and a User support email, choose External under Audience unless every user sits in your Workspace organisation, add an Email address under Contact Information, agree to the user data policy, then click Continue and Create.
Branding
The wizard then asks for Audience, Contact Information and the user data policy before Create.
Publish the app
Open Google Auth Platform → Audience. If Publishing status reads Testing, click Publish app and confirm. Publishing needs no review from Google.
Audience
Choose who can authorize this app to access their account data.
| Test users | Added |
|---|---|
| ops@acme.com | Mar 4, 2026 |
Once published this reads In production and the test-user list no longer applies.
Create a Web application OAuth client
Open Google Auth Platform → Clients and click Create client. Set Application type to Web application, name it PopMCP Tag Manager, click Add URI under Authorized redirect URIs, paste the callback URL from the PopMCP connect form exactly as shown, and click Create.
Create OAuth client ID
A client ID identifies a single app to Google's OAuth servers.
Leave Authorized JavaScript origins empty. Google matches the redirect URI character for character.
Copy the Client ID and Client Secret
Copy the Client ID and Client secret from the OAuth client created dialog before you close it. If the dialog is already gone, open the client from Clients and click Add secret to mint a new one.
Clients
| Name | Type | Client ID | Creation date |
|---|---|---|---|
| PopMCP Tag ManagerWeb application | Web | 7745****-m3p9 | Mar 4, 2026 |
After this dialog closes the console shows only the last four characters of the secret.
Paste the values into PopMCP, authorize, and pick the Tag Manager account
On PopMCP's Google Tag Manager connect form, paste the values into OAuth Client ID and OAuth Client Secret. Leave Tag Manager API requests per 100 seconds empty unless Google raised your project's quota. Click Authorize with Google, sign in with the account that has Tag Manager access, if Google shows a Google hasn't verified this app screen click Advanced and continue, and leave every Tag Manager permission ticked. Back in PopMCP, choose the Tag Manager account for this workspace.
Connect in PopMCP
Open your workspace, choose Google Tag Manager in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| OAuth Client IDtext | Google Cloud Console → Google Auth Platform → Clients → Create client → Web application, with the callback URL above under Authorized redirect URIs. Enable the Tag Manager API on the same project first (APIs & Services → Library → Tag Manager API → Enable). |
| OAuth Client Secretsecret | Shown once, right after you create the client. Stored encrypted here and used server-side only. In Google Auth Platform → Audience, if the status says "Testing", click "Publish app" first: Testing apps get a sign-in that Google ends after 7 days. Publishing needs no review from Google. On the consent screen, leave every Tag Manager permission ticked; a permission left off makes the tools that need it refuse with that reason.Encrypted with AES-256-GCM on save and never shown again. |
| Tag Manager API requests per 100 secondstext | Google gives every Cloud project 25 by default, and PopMCP spaces calls to stay under it. Change this only if Google raised your project's Tag Manager API quota (Google Cloud Console → IAM & Admin → Quotas). |
https://app.popmcp.com/api/providers/google/callbackPopMCP verifies the credential against Google Tag Manager immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Google Tag Manager at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| https://www.googleapis.com/auth/tagmanager.edit.containers | Reads and changes tags, triggers, variables, folders, templates, workspaces and environments, and creates containers. Every read tool accepts it, which is why PopMCP does not also ask for tagmanager.readonly. Without it nothing works, and the connect stops with "Google didn't grant access to Tag Manager". |
| https://www.googleapis.com/auth/tagmanager.edit.containerversions | Saves a workspace as a container version (create_version, and the first half of publish_workspace), builds a quick preview, and restores a deleted version. |
| https://www.googleapis.com/auth/tagmanager.publish | Makes a version live with publish_version or publish_workspace. Without it the AI can build and save changes but never push them to your site. |
| https://www.googleapis.com/auth/tagmanager.delete.containers | Deletes a container or a workspace. Leave it ticked unless you want deletes refused outright. |
| https://www.googleapis.com/auth/tagmanager.manage.users | Lists, adds, changes and removes who has access to the account and its containers. Google requires it even to read user permissions. |
| https://www.googleapis.com/auth/tagmanager.manage.accounts | Changes the Tag Manager account's own settings, such as its name and data-sharing setting. |
Verify it worked
After the consent screen PopMCP lists the Tag Manager accounts the Google account can open. Pick one and the connector shows Connected under that account's name. Ask the AI to list the containers and their GTM- ids come back.
Troubleshooting
Error 400: redirect_uri_mismatch
Why: The Authorized redirect URI on the client does not exactly match the callback URL PopMCP sends, usually a trailing slash or http instead of https.
Fix: Open the client under Google Auth Platform → Clients and paste the callback URL straight from the PopMCP connect form. Changes can take a few minutes to take effect.
The connection works for about a week, then stops with invalid_grant
Why: The app is still in Testing on the Audience page, so Google expired the refresh token 7 days after consent. PopMCP reports it as Google's 7 day Testing-mode expiry.
Fix: Go to Google Auth Platform → Audience, click Publish app, then reconnect Google Tag Manager in PopMCP.
A tool answers "needs the Tag Manager permission … which this connection was not granted. Nothing was sent."
Why: Google's consent screen gives each Tag Manager permission its own checkbox, and that one was left unticked. If edit containers itself was unticked, the connect stops with "Google didn't grant access to Tag Manager" instead.
Fix: Disconnect and reconnect Google Tag Manager, and leave every Tag Manager permission ticked on the consent screen.
403 accessNotConfigured, or "Tag Manager API has not been used in project"
Why: The Tag Manager API is not enabled on the project that owns the OAuth client.
Fix: Enable Tag Manager API in APIs & Services → Library on that same project, wait a minute, then retry.
403 saying the connected Google account's role in Tag Manager does not allow this
Why: The OAuth grant is fine, but the user's role in Tag Manager is too low for the action, for example Edit when publishing needs Publish.
Fix: In Tag Manager, an account Administrator opens Admin → User Management and raises the container permission (Read, Edit, Approve or Publish), or you connect with an account that already has it.
Calls wait, or are refused with "allows 25 requests per 100 seconds for this Google Cloud project"
Why: Google caps the Tag Manager API at 0.25 requests per second and 10,000 a day per Cloud project and answers anything over with 403. Other tools on the same project count too.
Fix: Retry after the time PopMCP gives, and read in bulk (get_live_version returns a whole container). For more, apply for a higher quota in the Cloud console and enter the new number in Tag Manager API requests per 100 seconds.
No Tag Manager account appears after you authorize
Why: The Google account you signed in with has not been added to any Tag Manager account.
Fix: Reconnect with the Google account listed under Admin → User Management in Tag Manager, or ask an account Administrator to add yours.
Reference
Google Data Studio
Connect Google Data Studio to find reports and data sources, audit and change who can open them, and build new reports from your templates.
Microsoft Clarity
Connect Microsoft Clarity to analyze traffic, engagement time, scroll depth, popular pages, and click quality metrics. MCP setup for Claude and ChatGPT.