Skip to main content
Connect Google Analytics 4 so CloudThinker can answer questions about traffic, key events, and active users. The connection uses a Google Cloud service account JSON key and reads only the properties that account can access.

​
Prerequisites

  • A Google Analytics 4 property that collects data, and Administrator access to grant a user access to it.
  • A Google Cloud project where you can create a service account, create a JSON key, and enable APIs. Your organization may restrict key creation; ask your Google Cloud administrator if it does.
  • The Admin role in your CloudThinker workspace. See Workspace roles.

​
Setup

1

Enable the Google Analytics APIs

In your Google Cloud project, enable both the Google Analytics Admin API and the Google Analytics Data API. Use the same project that will hold the service account.
2

Create a service account and key

In the Google Cloud console, create a service account. Open it, select Keys → Add key → Create new key, choose JSON, and click Create. Keep the downloaded file private. See Google’s guides to creating a service account and creating a key.
3

Grant access to your property

In Google Analytics, open Admin → Property access management for the property. Add the service account email with the Viewer role. Repeat for each property CloudThinker should read. See Google’s access guide.
4

Connect in CloudThinker

Open More → Workspace settings → Connections, select Builtin Connections, and search for Google Analytics. Click Connect, upload the JSON key under GOOGLE_SERVICE_ACCOUNT_KEY, and click Connect.Success state: the connection shows Connected. CloudThinker checks the service account’s access to Analytics accounts and properties.

​
Connection details

The connection checks account and property access when you connect. Ask a traffic question after setup to check that the Data API also works.

​
Required permissions

Grant the service account Viewer access on each property you want to query. Google Analytics account-level access can include all properties in that account, so choose the narrowest access you need.
Use a dedicated service account for CloudThinker. You can revoke its access without affecting other integrations.

​
Agent capabilities

A question goes from you to CloudThinker, which reads a Google Analytics property and returns an answer.A question goes from you to CloudThinker, which reads a Google Analytics property and returns an answer.

CloudThinker reads the Google Analytics properties available to your service account.

  1. You ask CloudThinker a question about a property.
  2. CloudThinker reads the data available to the service account.
  3. CloudThinker returns an answer using the data Google Analytics reports.
The connection cannot create or change Google Analytics settings, audiences, key events, or annotations. Make those changes in Google Analytics.

​
Verify the connection

A successful answer identifies the property and reports its data. If several properties are available, name the one you want. A new property with no events can return empty results.

​
Example prompts

​
Troubleshooting

In Google Analytics, open the property’s Property access management and add the service account email as a Viewer. Then test the connection again.
Enable the Google Analytics Admin API and Data API in the service account’s Google Cloud project. Check the service account’s property access, then retry.
Upload the complete JSON key file for a Google Cloud service account. If the key was deleted or disabled, create a new one and replace the saved credential.
Wait and retry with a narrower date range or breakdown. Google Analytics applies quotas to report requests.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Keep the JSON key out of chat and source control. Upload it only in the connection form.
  • Grant the service account access only to the properties you want CloudThinker to read.

Connections Overview

Learn how to manage connections and rotate credentials

Microsoft Clarity

Explore engagement and session recordings