Agent skill · data analytics · jeremylongshore
ga4-auth-setup
Configure auth for the GA4 Data API — OAuth user credentials for interactive use, or a service account for automation / CI. Pick the right path, set the right scopes, grant the right property-level access. Trigger with "set up GA4 auth", "GA4 service account", "GA4 OAuth", "connect to Google Analytics".
Why this skill is useful
Adds specific commands and workflows for setting up GA4 authentication that the AI wouldn't reliably generate on its own.
What it needs
Requires gcloud, python3 installed locally. Requires google-analytics account access. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
GA4 Auth Setup Overview GA4 has two production-grade auth paths. Pick before you start; mixing them mid-flight is the most common failure mode. Path When Credential file --- --- --- Service account Automation, CI, server-side scripts. Token is long-lived, scoped, revocable. ~/.config/gcloud/sa-ga4.json (or any path you choose) OAuth user creds Interactive use, multiple GA4 properties, ad-hoc analyst work. Token refreshes from a ~/.config/gcloud/applicationdefaultcredentials.json file. ADC Recommendation: service account for any pipeline / report-runner / agent use. OAuth for a human poking around. Don't share OAuth user creds across machines — that's an audit-trail mess. Prerequisites A Google Cloud project where you can create a service account and enable APIs, or a Google account with access to the target GA4 property. The GA4 property ID (digits only, not the G-... measurement ID). gcloud authenticated to the GCP project; the Python verification also needs the Google Analytics Data API client library installed. Instructions Examples Path A — Service account (recommended for automation) 1. Create the SA in GCP 2. Grant the SA access to your GA4 property This is the step everyone forgets. GA4 has property-level access control that lives in the Google Analytics web UI, NOT in GCP IAM. The service account email needs to be added there. 1. Open <https://analytics.google.com/> 2. Admin (bottom-left gear) → Property column → Property Access Management 3. Add user: paste $SAEMAIL (e.g. ga4-reader@your-project.iam.gserviceaccount.com) 4. Role: Viewer (read-only — anything more is over-privilege) 5. Save 3. Enable the Data API in the SA's project 4. Test the auth round-trip If you get rows back, auth works. If you get PermissionDenied: 403, the SA isn't added to the property (step 2). If you get Disabled: 403, the API isn't enabled (step 3). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/ga4-auth-setup