# Google Analytics 4 setup for PopMCP

You end up with two values from one Google Cloud OAuth client, the Client ID (…apps.googleusercontent.com) and the Client secret (GOCSPX-…), which you paste into PopMCP's OAuth Client ID and OAuth Client Secret fields.

- Auth: OAuth authorization
- Setup time: 12 min
- API base URL: https://analyticsdata.googleapis.com/v1beta
- Credentials screen: https://console.cloud.google.com/auth/clients
- Provider docs: https://developers.google.com/analytics/devguides/reporting/data/v1

## Before you begin

- A Google account with at least Viewer access on the GA4 property you want to read
- A Google Cloud project you can edit. The free tier is fine, because the Analytics APIs cost nothing
- The PopMCP callback URL, copied from the connector screen before you start
- Editor or Owner on the Cloud project, so you can enable APIs and create OAuth clients

## Get your credentials

### 1. Pick or create a Google Cloud project

Open the Google Cloud console and click the project picker in the top bar. Select an existing project, or click New project and name it `popmcp-analytics`.

Screen: https://console.cloud.google.com/projectcreate

### 2. Enable both Analytics APIs

Go to APIs & Services → Library, search for Google Analytics Data API and click Enable. Return to the library and do the same for the Google Analytics Admin API.

Screen: https://console.cloud.google.com/apis/library

### 3. Fill in Branding, then publish the app

Open Google Auth Platform → Branding and enter the App name and User support email. Open Audience, set User type to External, and click Publish app.

Screen: https://console.cloud.google.com/auth/audience

### 4. Create a Web application OAuth client

Go to Google Auth Platform → Clients and click Create client. Set Application type to Web application, name it `PopMCP`, then click Add URI under Authorized redirect URIs and paste the callback URL copied from PopMCP.

Screen: https://console.cloud.google.com/auth/clients/create

### 5. Copy the Client ID and secret into PopMCP

Copy both values from the OAuth client created dialog before you close it. Paste them into PopMCP's OAuth Client ID and OAuth Client Secret fields, click Connect, and pick the Google account with access to your GA4 property.

Screen: https://console.cloud.google.com/auth/clients

## Fields PopMCP asks for

- OAuth Client ID (clientId) [required]: From your Google Cloud project → APIs & Services → Credentials → OAuth client. Make sure the Google Analytics Admin API and Analytics Data API are enabled for that project first (APIs & Services → Library).
- OAuth Client Secret (clientSecret) [required]: Stored encrypted; used server-side only and never shown again.

## Callback URL to register

https://app.popmcp.com/api/providers/google/callback

## Scopes requested

- https://www.googleapis.com/auth/analytics.readonly
- https://www.googleapis.com/auth/analytics.edit

## Verify

PopMCP lists your GA4 properties by name after the consent screen, and asking for last week's sessions by channel returns numbers that match the Google Analytics UI.

## Troubleshooting

### Error 400: redirect_uri_mismatch

Cause: The Authorized redirect URI on the OAuth client is not byte-identical to the callback PopMCP sends.

Fix: Copy the callback straight out of PopMCP, paste it into Google Auth Platform → Clients → your client → Authorized redirect URIs, save, and retry. Changes can take a few minutes to propagate.

### The connection works for a week, then fails with invalid_grant

Cause: The OAuth app is still in Testing, so Google expires its refresh tokens after exactly 7 days.

Fix: Google Auth Platform → Audience → Publish app, then reconnect once in PopMCP to mint a fresh refresh token.

### 403 accessNotConfigured or SERVICE_DISABLED

Cause: The Analytics Data API or the Analytics Admin API was never enabled on the project that owns this client.

Fix: APIs & Services → Library, enable both Google Analytics Data API and Google Analytics Admin API on the same project, then retry.

### Connected, but no properties are listed

Cause: The Google account you consented with has no GA4 access, or you picked the wrong account at the chooser.

Fix: Give that account at least Viewer on the property in GA4 Admin → Property access management, then disconnect and reconnect.

### 429 RESOURCE_EXHAUSTED on big date ranges

Cause: Wide reports burn core tokens fast on standard properties.

Fix: Narrow the date range or the number of dimensions, or spread requests out. The hourly bucket refills every hour.

---

Source: https://www.docs.popmcp.com/docs/integrations/google-analytics/