Product analytics
Connect Google Analytics 4 to Sondola
What Sondola reads from Google Analytics 4: sessions, AI-assistant referral sessions. Read-only, with the source and period beside every number.
Read-only. Sondola never changes your data in Google Analytics 4.
- Credential
- Google service account key
- Refresh
- Once a day
- How it connects
- Collected automatically
- Setup time
- About 10 minutes
What Sondola reads from Google Analytics 4
- Sessions
- AI-assistant referral sessions
What you need
- You need permission to create a service account and key in the Google Cloud project, plus permission to grant access to the property you want to read. Search Console requires a property owner to add the service account. GA4 requires an Administrator on the property. No billing account is needed for these APIs.
Collection timing and the period a reading covers are separate. Check the source's data-through date as well as the metric's reporting period.
Connect Google Analytics 4 in 6 steps
- Optional: reuse an existing service account
A dedicated account for Sondola is the recommended path below. If you are allowed to reuse an existing account, select its Google Cloud project. Check that the Search Console API and Analytics Data API are enabled there. Create a separate JSON key for Sondola, then check access to every property you want to read in the final step. You can skip creating a project and service account.
A separate key can be revoked on its own. It still has all the service account’s permissions. Enabling an API does not grant access to a Search Console or GA4 property. - Create a Google Cloud project, or pick one you already have
A project is only a container for API access. Name it anything, for example acme-metrics. If your company already has a project, reuse it. Nothing here needs a new one.
Create a project ↗ - Enable the two APIs in that project
Open each link, check the project selector at the top shows your project, press Enable.
Google Search Console API ↗Google Analytics Data API ↗ - Create a service account
Open IAM and admin, then Service accounts, then Create service account. Use the name below. Press Create and continue, then Done. Skip the project role step. Property access is granted separately in Search Console or GA4.
Service account name: sondola-reader.Create a service account ↗ - Create a JSON key and paste it here
Open the service account → Keys → Add key → Create new key → JSON → Create. The file downloads once. Open it in a text editor and paste the contents into the field.
If your organisation blocks service account keys, ask its administrator whether a project-level exception is permitted. Keep setup within your organisation’s policy.Google: create a key ↗ - Give the service account access in each product
Its email is client_email inside the JSON, and we show it after you save. Search Console: Settings → Users and permissions → Add user → permission Restricted. GA4: Admin → Property access management → Add users → role Viewer.
Search Console permission: Restricted. GA4 role: Viewer.Search Console users ↗GA4 admin ↗
Enter credentials only in your Sondola workspace. Keep keys out of screenshots, public repositories and support messages.
What Sondola asks you for
The JSON key file Google downloads when you create a key for the service account (IAM & Admin → Service Accounts → the account → Keys → Add key → Create new key → JSON). Paste its contents here. Its client_email is the address you grant access to in Search Console and GA4.
Enabling an API grants nothing by itself. Each Search Console property and GA4 property needs the service account email added separately.Secrets are stored encrypted in your workspace, in a vault kept separate from the application database. Sondola never shows them again.
Permissions
- GA4 role: Viewer. Search Console permission: Restricted.
- No project role is needed. Property access is granted in each product.
- Save and test exchanges the key for a read-only token.
Refresh and first reading
Once a day. Most tools refresh once or twice a day, and every number shows when it was read.
Save and test exchanges the key for a read-only token and lists the Search Console sites the account can see. Pick the site on the Search Console tile and the property on the GA4 tile.
Troubleshooting
Save and test rejects the credential.
Enabling an API grants nothing by itself. Each Search Console property and GA4 property needs the service account email added separately. A separate key can be revoked on its own. It still has all the service account’s permissions. Enabling an API does not grant access to a Search Console or GA4 property.
The test passes but no reading appears.
The collector runs on its schedule, so a successful test does not mean a reading has landed. Check the source's data-through date and the metric's reporting period, and treat a missing reading as missing, not zero.
A number differs from Google Analytics 4.
Compare the definition, unit and reporting period with the same number in Google Analytics 4 before treating a difference as an error. When a stored reading changes, its history keeps the old value, the new value and the reason.
Provider documentation
Google Analytics 4 documentation
Readings missing or old? Read the setup and troubleshooting guide and the worked freshness example.
Related integrations
See your company clearly by Monday.
Apply in two minutes. Once you are in, your first numbers arrive minutes after you connect a tool.
Free for qualifying startups. Read-only.