Download

2. Connect your Google account

Choose one method. Most agencies use Google sign-in. You can add more connections later and mix both methods; each site picks one.

ComparedGoogle sign-in (OAuth)Service-account key
Best forYou already have access to the properties with your Google accountAgencies and long-running setups that shouldn’t depend on a person’s account
Search Console and GA4YesYes, after adding the service account as a user
Business ProfileYes, once Google approves API accessNo. Google doesn’t allow it
Needs HTTPSYesNo
Can stop working if…The app stays in “Testing” (7-day limit), the account loses access, or the app’s access is removed from the Google accountThe key is deleted in Google Cloud

Needs HTTPS. The only method that supports Business Profile.

Set up the consent screen

  1. Open Google Auth Platform → Branding and click Get started. Enter an app name (for example "TurtleReport for [your company]") and your support email.
  2. Under Audience, choose External. Choose Internal only if you use Google Workspace and everyone who connects is in your organisation (Internal apps have no 7-day limit and no warning screen).
  3. Add a contact email, accept the policy, and click Create.
  4. Open Google Auth Platform → Audience and click Publish app so the status reads In production.

Apps left in Testing lose their sign-in after 7 days

Publish the app before you connect, or you'll have to reconnect every week.

"Google hasn't verified this app" at sign-in?

That's expected for your own app: click Advanced → Go to [app name] (unsafe). Unverified apps allow up to 100 Google accounts, plenty when only admins connect. You don't need Google verification for your own use.

Create the OAuth client

  1. Open Google Auth Platform → Clients and click Create client.
  2. Application type: Web application. Name: anything.

  3. Leave Authorized JavaScript origins empty. Under Authorized redirect URIs, click Add URI and paste the exact address shown in TurtleReport → Setup guide. It looks like this:

    https://your-site.com/wp-admin/admin-post.php?action=turtlereport_oauth_callback

    It must match exactly, including https and the query string. If your admin is reached through more than one address, add each one.

  4. Click Create. Copy the Client ID and Client secret now. Google shows the full secret only once. If you lose it, open the client and use Add secret.

Connect in WordPress

  1. Go to TurtleReport → Connections → Sign in with Google, paste the Client ID and secret, and click Save and sign in with Google.
  2. Choose the Google account that has access to your Search Console and GA4 properties.
  3. On the permissions screen, tick every box. Unticked boxes mean missing data.

No sign-in to keep active, but no Business Profile.

Create the service account and key

  1. Open IAM & Admin → Service accounts and click Create service account. Give it a name (for example "turtlereport-reports") and click Create and continue.
  2. Skip the optional Permissions and Principals with access steps. It needs no Cloud roles. Click Done.
  3. Click the new service account, open the Keys tab, then Add key → Create new key → JSON → Create. A .json file downloads. Treat it like a password.
  4. Copy the service account's email. It looks like name@your-project.iam.gserviceaccount.com.

"Service account key creation is disabled"?

Many Google Cloud organisations enforce the iam.disableServiceAccountKeyCreation policy by default. Someone with the Organization Policy Administrator role can turn it off for this project under IAM & Admin → Organization policies → Disable service account key creation → Manage policy → Override parent's policy → Not enforced. If that's not possible, use Method A instead.

Give the service account access to each website

  • Search Console: open the property → Settings → Users and permissions → Add user. Paste the service account email, choose Restricted, click Add. You must be an owner of the property.
  • GA4: click Admin (gear icon) → under Property, Property access management → + → Add users. Paste the email, untick "Notify new users by email", choose the Viewer role, click Add. Use Account access management instead to cover every property in the account.
  • Go to TurtleReport → Connections → Advanced: service-account key and upload the JSON file. TurtleReport checks the key works before saving it.

New access can take a few minutes to show up. If a property is missing from the lists, wait, then click Reload lists from Google on the site screen.

Click Check connection on TurtleReport → Connections any time to see the account email and what a connection can read.

Next: Add a client website.