Skip to content
OpenSEO
Get started

Docs / Run it yourself

Set up Google sign-in

Create the Google OAuth client that lets users connect Search Console and Analytics to your install.

Users connect Search Console and Google Analytics through an OAuth client that belongs to whoever runs the OpenSEO install. Without one, the Search performance page explains that Google is not set up, and nothing else is affected. It takes about ten minutes in Google Cloud.

Create the OAuth client

  1. Create or choose a Google Cloud project

    In the Google Cloud console, create a project for OpenSEO, or use an existing one.

  2. Enable the APIs

    Under APIs and services, enable the Google Search Console API, the Google Analytics Admin API and the Google Analytics Data API.

  3. Configure the consent screen

    Set the app name, support email and your domain. Add the scopes https://www.googleapis.com/auth/webmasters.readonly and https://www.googleapis.com/auth/analytics.readonly, plus openid and email. While the app is in testing, only test users you list can connect; publishing it for other users may need Google's verification.

  4. Create a web application client

    Create an OAuth client ID of type Web application with these authorised redirect URIs, where APP_URL is your dashboard's address:

    Redirect URIs
    {APP_URL}/api/google/gsc/callback
{APP_URL}/api/google/ga4/callback

    The Search performance page lists the exact URIs for your install while Google is not set up.

  5. Add the client to the API's environment

    .env
    GOOGLE_CLIENT_ID=1234567890-abc.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=GOCSPX-...

    Restart the API. The Search performance page now offers to connect accounts.

How the connection works

  • Each product is a separate grant with a read-only scope, apart from signing in to OpenSEO. Connecting Search Console never grants Analytics, or the other way round.
  • The redirect goes through the dashboard's address, so the user's session comes along and the grant is stored for the person who started it.
  • Each attempt has a random state that works once and expires after 10 minutes, tied to the user it was issued to, and uses PKCE. A callback with someone else's state, an old one or a replayed one is refused.
  • If the user unticks the permission on Google's consent screen, nothing is stored and the page says why.
  • Access and refresh tokens are encrypted with ENCRYPTION_KEY. Access tokens are refreshed shortly before they expire. If Google withdraws the grant, the page asks the user to reconnect.
  • Nothing Google returns is stored. Google's API quotas apply; when one is used up the page says so.