Connect Google Search Console and GA4

Connecting Google brings your Search Console and Google Analytics 4 data into RankKit SEO → Analytics: clicks, impressions, rankings, traffic and visits from AI assistants. The same data feeds the audit, the AI writer and your AI agents.

RankKit SEO asks for read-only access, and the data goes straight from Google to your site. There is no RankKit SEO account or server in between, which is why you use your own Google Cloud credentials instead of a shared RankKit SEO app. Connecting is free.

Tip Already use Site Kit by Google? RankKit SEO can use Site Kit's Google connection instead, with no Google Cloud project. See Use Site Kit by Google's connection.

Before you start

• You need to be a WordPress administrator.
• Your site must already be verified in Google Search Console. If it isn't, add the verification code first: see Verify your site with Google, Bing and others.
• For GA4 data, you need a GA4 property that collects data from your site. If nothing adds the GA4 tag yet, see Add the Google Analytics 4 tag.

Choose a method

Go to RankKit SEO → Analytics. The Connect Google Search Console and Analytics card offers two tabs:

Method	Best for	What you set up in Google
Sign in with Google	Most single sites	An OAuth client in Google Cloud, then you sign in with the Google account that owns Search Console and GA4.
Service account	Agencies, many sites, sites behind a firewall	A service account and its JSON key, added as a user in Search Console and GA4. No sign-in redirect is needed.

Both methods give the same reports. You can switch later by disconnecting and connecting again.

Method 1: Sign in with Google (OAuth)

Step 1: Create a project and enable the APIs

1. Open the Google Cloud console and sign in with the Google account that has access to your Search Console property and GA4 property.
2. Create a project from the project picker at the top (for example "RankKit SEO example.com"), or select an existing one.
3. Go to APIs & Services → Library. Search for each of these APIs, open it and click Enable:
   • Google Search Console API
   • Google Analytics Data API
   • Google Analytics Admin API

The Admin API lets RankKit SEO list your GA4 properties. The Data API reads the reports.

Step 2: Configure the OAuth consent screen

1. Go to APIs & Services → OAuth consent screen. Google opens the Google Auth Platform. Click Get started if the project has no consent screen yet.
2. Enter an App name (for example "RankKit SEO") and pick your email as User support email.
3. Under Audience, choose External. (If your Google account belongs to a Google Workspace organization and the Search Console owner is in the same organization, Internal also works.)
4. Add your contact email, agree to the Google API Services User Data Policy and click Create.
5. For an External app, open Audience and, under Test users, click Add users and add the Google account you will sign in with.

Important While an External app's publishing status is Testing, Google expires its sign-in after 7 days, and RankKit SEO then loses access until you reconnect. To avoid this, click Publish app on the Audience page. Your app is not verified by Google, so the sign-in screen shows a "Google hasn't verified this app" warning. That is expected for an app only you use: click Advanced, then continue to your app. Internal apps and service accounts don't have this limit.

Step 3: Create the OAuth client

1. In RankKit SEO, on the Sign in with Google tab, copy the authorised redirect URI shown in step 3 of the instructions. It looks like this:

   https://example.com/wp-admin/admin-post.php?action=speedrank_google_callback
   

   Always copy it from RankKit SEO rather than typing it. It must match exactly, including https and www.

2. In Google Cloud, go to Google Auth Platform → Clients (or APIs & Services → Credentials → Create credentials → OAuth client ID).

3. Click Create client and set Application type to Web application. Give it a name.

4. Under Authorized redirect URIs, click Add URI and paste the redirect URI from RankKit SEO. You don't need any JavaScript origins.

5. Click Create. Google shows the Client ID and Client secret. Copy both now: Google may not show the secret again, and you can only create a new one.

Step 4: Sign in

1. Back in RankKit SEO → Analytics, paste the Client ID (it ends in .apps.googleusercontent.com) and the Client secret.
2. Click Sign in with Google.
3. Choose the Google account that owns Search Console and GA4 and allow the read-only access RankKit SEO asks for (Search Console and Analytics, both read-only, plus your email address).
4. Google sends you back to RankKit SEO, which shows Connected. Now choose your properties. Continue with Choose your properties below.

Method 2: Service account

A service account is a robot Google account that belongs to your Google Cloud project. You give its email address read access in Search Console and GA4, and RankKit SEO signs in with its key. One service account can serve many client sites.

Your server needs the PHP OpenSSL extension (most hosts have it). Without it RankKit SEO shows "Service accounts need the PHP OpenSSL extension".

Step 1: Enable the APIs

In the Google Cloud console, create or select a project, then in APIs & Services → Library enable the Google Search Console API, Google Analytics Data API and Google Analytics Admin API.

Step 2: Create the service account and its key

1. Go to IAM & Admin → Service accounts and click Create service account.
2. Enter a name (for example "speedrank-reports") and click Create and continue. It needs no project roles: skip the optional steps and click Done.
3. Open the new service account and copy its email address. It looks like speedrank-reports@your-project.iam.gserviceaccount.com.
4. Open the Keys tab, click Add key → Create new key, choose JSON and click Create. A .json file downloads.

Keep the key file private: anyone with it can read the data you share with the service account.

Step 3: Give the service account access in Search Console

1. Open Search Console and select your property. You must be an owner of the property.
2. Go to Settings → Users and permissions and click Add user.
3. Paste the service account email. Restricted permission is enough to read performance data; Full also works.
4. Click Add.

Step 4: Give the service account access in GA4

1. Open Google Analytics and go to Admin.
2. Under Property settings, open Property access management.
3. Click +, then Add users.
4. Paste the same service account email, choose the Viewer role and click Add.

Step 5: Connect in RankKit SEO

1. In RankKit SEO → Analytics, open the Service account tab.
2. Paste the contents of the key file into Service account JSON key, or click Load key file and choose the .json file.
3. Click Connect. RankKit SEO tests the key with Google before saving it.

Choose your properties

Once connected, the card at the top of RankKit SEO → Analytics shows Connected to Google, the account email and the method (Google sign-in or Service account). Pick:

• Search Console: the property for this site. RankKit SEO lists every property the account can read and puts the best match for your site first, marked with a check mark. A Domain property (sc-domain:example.com) and a URL-prefix property for your exact home URL both match.
• Google Analytics 4: the GA4 property that collects your site's traffic, shown as "Property name (Account name)".

Each choice saves straight away. Search Console reports need the Search Console property and the GA4 reports need the GA4 property; you can connect just one of them if you only use one.

When everything is set, read Search and traffic reports to see what each tab shows.

Disconnect

Click Disconnect on the connection card.

• With Google sign-in, RankKit SEO revokes its access at Google (the refresh token), then deletes the stored client ID, secret, token and property choices from your site.
• With a service account, RankKit SEO deletes the stored key. The key itself stays valid in Google Cloud: if you no longer need it, delete it under IAM & Admin → Service accounts → Keys, and remove the email from Search Console and GA4.

Disconnecting also clears cached Google data. Your SEO settings and content are not affected.

Troubleshooting

Problem	Cause	Fix
Google shows redirect_uri_mismatch	The redirect URI in the OAuth client doesn't match the one RankKit SEO shows.	Copy the URI from RankKit SEO again and paste it into Authorized redirect URIs exactly, then try again.
Google sign-in did not complete with "Google did not return a refresh token"	Wrong client secret or redirect URI.	Check both, then click Sign in with Google again.
Google sign-in did not complete with "Error: state"	The sign-in took longer than 15 minutes, or was started by another user.	Start the sign-in again from RankKit SEO → Analytics.
"Enter the OAuth client ID from Google Cloud and its client secret."	The client ID isn't in the ….apps.googleusercontent.com format, or the secret is empty.	Copy the Client ID of a Web application client, not the project ID or an API key.
"Google sign-in failed: …" a week after connecting	The consent screen is still in Testing, so Google expired the sign-in.	Publish the app (see the warning above), then disconnect and sign in again. Or switch to a service account.
"This is not a Google service account key file."	The pasted text isn't the full JSON key.	Paste the whole file, from the first { to the last }, or use Load key file.
No properties in the dropdowns, or an error under Search Console or Google Analytics	The account has no access, or an API isn't enabled.	Enable all three APIs in the same Google Cloud project, and check that the account or service account email was added in Search Console and GA4.
Google Cloud won't create a key ("Service account key creation is disabled")	An organization policy blocks service account keys.	Ask your Google Cloud organization admin to allow keys for this project, or use Sign in with Google.

FAQ

Why do I need my own Google Cloud client?

So your data and tokens never pass through a third-party server. Google sends the data straight to your WordPress site. Agencies can also reuse one service account across many client sites.

Does RankKit SEO change anything in Search Console or GA4?

No. It only requests read-only access to Search Console and Analytics.

Is the Google connection part of RankKit SEO Pro?

No. Connecting Google and the Search performance and Traffic & AI referrals reports are free. Pro adds opportunities, the rank tracker, AI insights, Traffic Recovery and per-post performance on top of the same connection. See RankKit SEO Free vs Pro.

Do I still need the Search Console verification code?

Verification is separate from connecting. Google needs to know you own the site before Search Console has data, so verify first (with RankKit SEO's Webmaster tools settings or any other method), then connect.