# Google Tag Manager setup for PopMCP You end up pasting the OAuth Client ID and Client Secret of a Web application client from a Google Cloud project with the Tag Manager API enabled, then choosing which Tag Manager account the connection works in. - Auth: OAuth authorization - Setup time: 10 min - API base URL: https://tagmanager.googleapis.com/tagmanager/v2 - Credentials screen: https://console.cloud.google.com/auth/clients - Provider docs: https://developers.google.com/tag-platform/tag-manager/api/v2 ## Before you begin - A Google account with access to the Tag Manager account. Reading needs Read on a container, editing needs Edit, creating versions needs Approve, publishing needs Publish, and managing users needs the account's Administrator role - A Google Cloud project you own, with Owner or Editor so you can enable APIs and create OAuth clients. The Tag Manager API itself is free - Ideally a project used only for this connection: Google allows 25 Tag Manager API requests per 100 seconds and 10,000 a day per Cloud project, shared by everything that uses it - The PopMCP callback URL, copied from the Google Tag Manager connect form before you start - Personal gmail.com accounts can only use the External audience. Internal needs a Google Workspace organisation ## Get your credentials ### 1. Enable the Tag Manager API Pick or create a project in the top bar, then open APIs & Services → Library. Search for Tag Manager API, open its card and click Enable. Screen: https://console.cloud.google.com/apis/library/tagmanager.googleapis.com ### 2. Fill in the Google Auth Platform branding Open Google Auth Platform → Branding. If it says Google Auth platform not configured yet, click Get Started. Enter an App name and a User support email, choose External under Audience unless every user sits in your Workspace organisation, add an Email address under Contact Information, agree to the user data policy, then click Continue and Create. Screen: https://console.cloud.google.com/auth/branding ### 3. Publish the app Open Google Auth Platform → Audience. If Publishing status reads Testing, click Publish app and confirm. Publishing needs no review from Google. Screen: https://console.cloud.google.com/auth/audience ### 4. Create a Web application OAuth client Open Google Auth Platform → Clients and click Create client. Set Application type to Web application, name it `PopMCP Tag Manager`, click Add URI under Authorized redirect URIs, paste the callback URL from the PopMCP connect form exactly as shown, and click Create. Screen: https://console.cloud.google.com/auth/clients/create ### 5. Copy the Client ID and Client Secret Copy the Client ID and Client secret from the OAuth client created dialog before you close it. If the dialog is already gone, open the client from Clients and click Add secret to mint a new one. Screen: https://console.cloud.google.com/auth/clients ### 6. Paste the values into PopMCP, authorize, and pick the Tag Manager account On PopMCP's Google Tag Manager connect form, paste the values into OAuth Client ID and OAuth Client Secret. Leave Tag Manager API requests per 100 seconds empty unless Google raised your project's quota. Click Authorize with Google, sign in with the account that has Tag Manager access, if Google shows a Google hasn't verified this app screen click Advanced and continue, and leave every Tag Manager permission ticked. Back in PopMCP, choose the Tag Manager account for this workspace. ## Fields PopMCP asks for - OAuth Client ID (clientId) [required]: Google Cloud Console → Google Auth Platform → Clients → Create client → Web application, with the callback URL above under Authorized redirect URIs. Enable the Tag Manager API on the same project first (APIs & Services → Library → Tag Manager API → Enable). - OAuth Client Secret (clientSecret) [required]: Shown once, right after you create the client. Stored encrypted here and used server-side only. In Google Auth Platform → Audience, if the status says "Testing", click "Publish app" first: Testing apps get a sign-in that Google ends after 7 days. Publishing needs no review from Google. On the consent screen, leave every Tag Manager permission ticked; a permission left off makes the tools that need it refuse with that reason. - Tag Manager API requests per 100 seconds (quotaPer100Seconds): Google gives every Cloud project 25 by default, and PopMCP spaces calls to stay under it. Change this only if Google raised your project's Tag Manager API quota (Google Cloud Console → IAM & Admin → Quotas). ## Callback URL to register https://app.popmcp.com/api/providers/google/callback ## Scopes requested - https://www.googleapis.com/auth/tagmanager.edit.containers - https://www.googleapis.com/auth/tagmanager.edit.containerversions - https://www.googleapis.com/auth/tagmanager.publish - https://www.googleapis.com/auth/tagmanager.delete.containers - https://www.googleapis.com/auth/tagmanager.manage.users - https://www.googleapis.com/auth/tagmanager.manage.accounts ## Verify After the consent screen PopMCP lists the Tag Manager accounts the Google account can open. Pick one and the connector shows Connected under that account's name. Ask the AI to list the containers and their GTM- ids come back. ## Troubleshooting ### Error 400: redirect_uri_mismatch Cause: The Authorized redirect URI on the client does not exactly match the callback URL PopMCP sends, usually a trailing slash or http instead of https. Fix: Open the client under Google Auth Platform → Clients and paste the callback URL straight from the PopMCP connect form. Changes can take a few minutes to take effect. ### The connection works for about a week, then stops with invalid_grant Cause: The app is still in Testing on the Audience page, so Google expired the refresh token 7 days after consent. PopMCP reports it as Google's 7 day Testing-mode expiry. Fix: Go to Google Auth Platform → Audience, click Publish app, then reconnect Google Tag Manager in PopMCP. ### A tool answers "needs the Tag Manager permission … which this connection was not granted. Nothing was sent." Cause: Google's consent screen gives each Tag Manager permission its own checkbox, and that one was left unticked. If edit containers itself was unticked, the connect stops with "Google didn't grant access to Tag Manager" instead. Fix: Disconnect and reconnect Google Tag Manager, and leave every Tag Manager permission ticked on the consent screen. ### 403 accessNotConfigured, or "Tag Manager API has not been used in project" Cause: The Tag Manager API is not enabled on the project that owns the OAuth client. Fix: Enable Tag Manager API in APIs & Services → Library on that same project, wait a minute, then retry. ### 403 saying the connected Google account's role in Tag Manager does not allow this Cause: The OAuth grant is fine, but the user's role in Tag Manager is too low for the action, for example Edit when publishing needs Publish. Fix: In Tag Manager, an account Administrator opens Admin → User Management and raises the container permission (Read, Edit, Approve or Publish), or you connect with an account that already has it. ### Calls wait, or are refused with "allows 25 requests per 100 seconds for this Google Cloud project" Cause: Google caps the Tag Manager API at 0.25 requests per second and 10,000 a day per Cloud project and answers anything over with 403. Other tools on the same project count too. Fix: Retry after the time PopMCP gives, and read in bulk (get_live_version returns a whole container). For more, apply for a higher quota in the Cloud console and enter the new number in Tag Manager API requests per 100 seconds. ### No Tag Manager account appears after you authorize Cause: The Google account you signed in with has not been added to any Tag Manager account. Fix: Reconnect with the Google account listed under Admin → User Management in Tag Manager, or ask an account Administrator to add yours. --- Source: https://www.docs.popmcp.com/docs/integrations/google-tag-manager/