> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Google Analytics > Connect Google Analytics so CloudThinker can read traffic, key events, and realtime activity with a service account key. Connect Google Analytics 4 so [CloudThinker](https://docs.cloudthinker.io/guide/agents/overview.md) can answer questions about traffic, key events, and active users. The connection uses a Google Cloud service account JSON key and reads only the properties that account can access. ## Prerequisites * A Google Analytics 4 property that collects data, and Administrator access to grant a user access to it. * A Google Cloud project where you can create a service account, create a JSON key, and enable APIs. Your organization may restrict key creation; ask your Google Cloud administrator if it does. * The Admin role in your CloudThinker workspace. See [Workspace roles](https://docs.cloudthinker.io/guide/workspace-users.md#workspace-roles). ## Setup **1. Enable the Google Analytics APIs** In your Google Cloud project, enable both the [Google Analytics Admin API](https://console.cloud.google.com/apis/library/analyticsadmin.googleapis.com) and the [Google Analytics Data API](https://console.cloud.google.com/apis/library/analyticsdata.googleapis.com). Use the same project that will hold the service account. **2. Create a service account and key** In the [Google Cloud console](https://console.cloud.google.com/), create a service account. Open it, select **Keys → Add key → Create new key**, choose **JSON**, and click **Create**. Keep the downloaded file private. See Google's guides to [creating a service account](https://docs.cloud.google.com/iam/docs/service-accounts-create) and [creating a key](https://docs.cloud.google.com/iam/docs/keys-create-delete). **3. Grant access to your property** In Google Analytics, open **Admin → Property access management** for the property. Add the service account email with the **Viewer** role. Repeat for each property CloudThinker should read. See [Google's access guide](https://support.google.com/analytics/answer/9305788). **4. Connect in CloudThinker** Open **More → Workspace settings → Connections**, select **Builtin Connections**, and search for **Google Analytics**. Click **Connect**, upload the JSON key under **GOOGLE\_SERVICE\_ACCOUNT\_KEY**, and click **Connect**. **Success state:** the connection shows **Connected**. CloudThinker checks the service account’s access to Analytics accounts and properties. ## Connection details | Field | What to enter | | - | - | | **GOOGLE\_SERVICE\_ACCOUNT\_KEY** | The JSON key file for the service account with access to your Analytics properties | The connection checks account and property access when you connect. Ask a traffic question after setup to check that the Data API also works. ## Required permissions Grant the service account **Viewer** access on each property you want to query. Google Analytics account-level access can include all properties in that account, so choose the narrowest access you need. > [!TIP] > > Use a dedicated service account for CloudThinker. You can revoke its access without affecting other integrations. ## Agent capabilities ![A question goes from you to CloudThinker, which reads a Google Analytics property and returns an answer.](https://mintcdn.com/cloudthinker/J6CmMESa4pMjx8UR/images/connections/google-analytics/01-read-flow-light.svg?fit=max\&auto=format\&n=J6CmMESa4pMjx8UR\&q=85\&s=437fd0f3f6d35a52e0bf5635095d371d) CloudThinker reads the Google Analytics properties available to your service account. 1. You ask CloudThinker a question about a property. 2. CloudThinker reads the data available to the service account. 3. CloudThinker returns an answer using the data Google Analytics reports. | Capability | What CloudThinker can do | | - | - | | Properties | List accessible accounts and properties, and inspect property details | | Traffic | Compare users, sessions, engagement, and key events across periods; break results down by source, channel, page, country, device, or event | | Realtime activity | Read active users and recent events, with page, country, device, platform, or event breakdowns | | Configuration | Read custom definitions, Google Ads links, and annotations | The connection cannot create or change Google Analytics settings, audiences, key events, or annotations. Make those changes in Google Analytics. ### Verify the connection ```text theme={null} List my Google Analytics properties and show users and sessions for the last 7 days for my main property. ``` A successful answer identifies the property and reports its data. If several properties are available, name the one you want. A new property with no events can return empty results. ### Example prompts ```text theme={null} Which channels brought the most sessions to my website over the last 28 days? Compare key events this week with the previous week for my main property. How many active users are on my site right now, broken down by page? ``` ## Troubleshooting > [accordion] The service account sees no property > > In Google Analytics, open the property's **Property access management** and add the service account email as a **Viewer**. Then test the connection again. > [accordion] Google Analytics reports an API or permission error > > Enable the Google Analytics Admin API and Data API in the service account's Google Cloud project. Check the service account's property access, then retry. > [accordion] The key is rejected > > Upload the complete JSON key file for a Google Cloud service account. If the key was deleted or disabled, create a new one and replace the saved credential. > [accordion] A report reaches a quota limit > > Wait and retry with a narrower date range or breakdown. Google Analytics applies quotas to report requests. ## Security * **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later. * **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection. * **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection. * **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves. - Keep the JSON key out of chat and source control. Upload it only in the connection form. - Grant the service account access only to the properties you want CloudThinker to read. ## Related > [card] [Connections Overview](https://docs.cloudthinker.io/guide/connections/overview.md) > > Learn how to manage connections and rotate credentials > [card] [Microsoft Clarity](https://docs.cloudthinker.io/guide/connections/clarity.md) > > Explore engagement and session recordings This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.