# Google Data Studio setup for PopMCP

You end up pasting the OAuth Client ID and Client Secret of an Internal Web application client from a Google Cloud project with the Data Studio API turned on, after a Google Workspace super admin has authorized that Client ID for the Data Studio scopes under domain-wide delegation.

- Auth: OAuth authorization
- Setup time: 10 min
- API base URL: https://datastudio.googleapis.com/v1
- Credentials screen: https://console.cloud.google.com/apis/library/datastudio.googleapis.com
- Provider docs: https://developers.google.com/looker-studio/integrate/api

## Approval required before this works

Google opens the Data Studio API only to Google Workspace or Cloud Identity accounts, after a super admin authorizes the app once. Personal Gmail accounts cannot use it.

- Typical wait: None from Google. The admin step takes a minute, and Google says it can take up to 24 hours to apply
- Cost: The API is free. It needs a Google Workspace subscription or Cloud Identity, whose Free edition costs nothing.
- Blocked until approved: Everything. Until a super admin authorizes the app, Google refuses the sign-in with Error 400: invalid_scope, and a personal account cannot be authorized at all.
- Works meanwhile: Create the Google Cloud project, turn on the Data Studio API and make the Internal OAuth client, then send its Client ID to your admin.

## Before you begin

- A Google Workspace or Cloud Identity account. Google opens the Data Studio API (now named Data Studio API) only to accounts that belong to such an organization; personal gmail.com accounts cannot use it
- A super administrator of that Workspace organization for one step in the Admin console, or the role yourself
- A Google Cloud project in your organization where you can turn on APIs and create OAuth clients (Owner or Editor). The API is free
- The PopMCP callback URL, copied from the Google Data Studio connect form before you start
- Data Studio was renamed Data Studio in April 2026: the console, Google's docs and the app may show either name

## Get your credentials

### 1. Turn on the Data Studio API

Pick or create a project of your Workspace organization in the top bar, then open APIs & Services → Library. Search for Data Studio API (older consoles list it as Data Studio API; the service name is `datastudio.googleapis.com`), open its card and click Enable.

Screen: https://console.cloud.google.com/apis/library/datastudio.googleapis.com

### 2. Set up Google Auth Platform with an Internal audience

Open Google Auth Platform → Branding. If it says Google Auth platform not configured yet, click Get Started. Enter an App name and a User support email, choose Internal under Audience, add an Email address under Contact Information, agree to the user data policy, then click Continue and Create. Do not add the Data Studio scopes on Data access: your admin authorizes them in the Admin console instead.

Screen: https://console.cloud.google.com/auth/branding

### 3. Create a Web application OAuth client

Open Google Auth Platform → Clients and click Create client. Set Application type to Web application, name it `PopMCP Data Studio`, click Add URI under Authorized redirect URIs, paste the callback URL from the PopMCP connect form exactly as shown, and click Create.

Screen: https://console.cloud.google.com/auth/clients/create

### 4. Copy the Client ID and Client Secret

Copy the Client ID and Client secret from the OAuth client created dialog before you close it. If the dialog is already gone, open the client from Clients and click Add secret to make a new one. Your admin needs the Client ID in the next step.

Screen: https://console.cloud.google.com/auth/clients

### 5. Have a Workspace super admin authorize the Client ID

A super administrator opens the Google Admin console at admin.google.com → Security → Access and data control → API controls → Manage Domain Wide Delegation and clicks Add new. They enter your Client ID, add each of these under OAuth Scopes: `https://www.googleapis.com/auth/datastudio`, `https://www.googleapis.com/auth/datastudio.readonly` and `https://www.googleapis.com/auth/userinfo.email` (the connect form has them ready to copy), then click Authorize. Google says this can take up to 24 hours, though it is usually quicker.

Screen: https://admin.google.com/ac/owl/domainwidedelegation

### 6. Paste the values into PopMCP and sign in with Google

On PopMCP's Google Data Studio connect form, paste the values into OAuth Client ID and OAuth Client Secret and click Sign in with Google. Choose your work account. Google signs you in without a consent screen when the admin step is done, and PopMCP connects as that account.

## Fields PopMCP asks for

- OAuth Client ID (clientId) [required]: In Google Cloud Console, in a project of your Workspace organization: turn on the Data Studio API (APIs & Services → Library), set Google Auth Platform → Audience to Internal, then Clients → Create client → Web application with the callback URL above under Authorized redirect URIs.
- OAuth Client Secret (clientSecret) [required]: Shown when you create the client. Stored encrypted and used server-side only.
- Scopes your Workspace super admin authorizes (adminScopes): Before you sign in, a Google Workspace super admin adds your Client ID with these scopes: Admin console → Security → Access and data control → API controls → Manage Domain Wide Delegation → Add new. Until then Google shows "Error 400: invalid_scope" (it can take up to 24 hours to apply). Personal Gmail accounts cannot use Data Studio's API.

## Callback URL to register

https://app.popmcp.com/api/providers/google/callback

## Scopes requested

- https://www.googleapis.com/auth/datastudio
- https://www.googleapis.com/auth/userinfo.email

## Verify

After you sign in PopMCP shows Connected under your work email. Ask the AI to list your Data Studio reports and their titles and links come back.

## Troubleshooting

### Google shows Error 400: invalid_scope

Cause: Your organization has not authorized this Client ID for the Data Studio scopes, or authorized a different Client ID or fewer scopes. Google refuses every app a Workspace admin has not authorized.

Fix: Ask a super admin to add the exact Client ID with all three scopes under Security, Access and data control, API controls, Manage Domain Wide Delegation, then try again. It can take up to 24 hours to apply.

### "This is a personal Google account" when connecting

Cause: You signed in with a gmail.com account. Google opens the Data Studio API only to Google Workspace and Cloud Identity accounts.

Fix: Sign in with your work account. To reach reports a personal account owns, share them with your work account first.

### Access blocked: the app can only be used within its organization

Cause: The OAuth app is Internal and you signed in with an account from another organization.

Fix: Sign in with an account of the organization that owns the Google Cloud project, or create the client in a project of your own organization.

### Error 400: redirect_uri_mismatch

Cause: The Authorized redirect URI on the client does not exactly match the callback URL PopMCP sends, usually a trailing slash or http instead of https.

Fix: Open the client under Google Auth Platform → Clients and paste the callback URL straight from the PopMCP connect form. Changes can take a few minutes to apply.

### 403 saying the Data Studio API has not been used in the project or is disabled

Cause: The API is not turned on in the project that owns the OAuth client.

Fix: Turn on the Data Studio API in APIs & Services → Library on that same project, wait a minute, then retry.

### A sharing change is refused because the connection can read only

Cause: Google granted only datastudio.readonly, usually because the admin authorized just that scope, or the connection is read-only in PopMCP.

Fix: Have the admin add https://www.googleapis.com/auth/datastudio to the Client ID and reconnect, and allow write actions on the connection in PopMCP.

---

Source: https://www.docs.popmcp.com/docs/integrations/google-data-studio/