Search Console and GA4
Two checks depend on this connection. Without it they report a gap rather than a guess.
What it enables
Ranking absent and ranking weak are both Search Console dependent. With the connection they report against real impression and position data. Without it they report that they could not look.
Connected by OAuth
Standard Google OAuth. Tokens are stored in the per client credential vault, encrypted, and never returned in plaintext by any endpoint.
Read only, and only the two scopes
The connection asks for analytics.readonly and webmasters.readonly and nothing else. It cannot change a property setting, submit a sitemap, or alter your data, because those permissions are never requested. You can revoke it from your Google account at any time and the rest of the audit keeps running unchanged.
How the tokens are stored
Refresh tokens are encrypted with AES-256-GCM under a key derived per client through HKDF, so a leak of one client record does not expose another. No endpoint returns a stored secret. Reading one back gives you its name, a four character preview, and when it was set.
What it does not do
This connection does not make us your analytics tool. We read the impression, click and position rows for pages we already crawled, and we use them to answer two checks. There is no dashboard rebuilding what Search Console already shows you well, because that would be a worse version of a product you already have.
Questions
Do you need write access?
No. Read only for both.
More in Connect and scale
- Six engines, live answers
AI engine tracking
We run real prompts against six consumer answer engines and record whether you were mentioned, where in the answer, in what tone, and which sources were cited.
Read more - Tenant id is the first argument, always
Client workspaces
Every client is a tenant. Isolation is enforced by the shape of the code, not by remembering to filter, and a record belonging to another client answers 404.
Read more - AES-256-GCM, per client key via HKDF
Credential vault
Client credentials are encrypted with AES-256-GCM under a per-client key. No endpoint returns a plaintext secret, including to you.
Read more
Run it against your own site.
No signup, no card. It reports what it could not check as well as what it found.