← All services

You make

a service account's key file (one file, also good for Search Console)

Where

https://console.cloud.google.com/iam-admin/serviceaccounts/create

Command

kokuban connect ga --key-file <file.json> --account <property id>

Steps

1. Pick or make a Google Cloud project, and turn on the Google Analytics Data API and Admin APISearch for each API by name in the console's API Library and press Enable.
2. Make a service account named kokuban (no roles needed)
3. On it: Keys, Add key, JSON. A file downloadsThe file is the key itself. kokuban keeps what is in it in your OS keychain; delete the downloaded file afterwards.
4. In Google Analytics: Admin, Property access management, add the service account's address as ViewerThe service account's address ends in .iam.gserviceaccount.com. kokuban prints it when you connect.
5. Your property's ID is in Admin, Property details (only digits)

Then connect it

kokuban asks for the key (it is not shown as you paste it), keeps it in your OS keychain, and tries it at once. If the key cannot do something, it says what to change.

On kokuban's screen, the connections list shows the services not connected yet: open one and press y, and the screen hands the terminal to this command.

Good to know

• One key file can serve Google Analytics and Search Console both; connect each with it.
• Why a service account and not "Sign in with Google": kokuban registers no app of its own anywhere, and a Google app you make yourself stays in testing, where Google ends its sign-in every 7 days. A service account does not expire.
• If the console says key creation is not allowed, your organization blocks service account keys (iam.disableServiceAccountKeyCreation); ask its administrator, or use a project outside it.

If it does not work

kokuban connections checks every connection and says which ones need you.

Taking it back

Run kokuban disconnect ga@hq, remove the service account in Property access management, and delete its key in the Google Cloud console.