Connect Google Search Console and GA4
Search Console and GA4 connect through your own Google Cloud OAuth client, so tokens land in your database and your traffic data never passes through RankBull. It's a one-time, five-minute setup, and this page is the exact path — including the three gotchas that cause nearly every failed attempt. No paid Google account needed anywhere.
What you'll need
- A Google account that can access your Search Console property / GA4
- Your RankBull dashboard open at Settings → Analytics
- Your Convex dashboard (the project you created at setup)
The steps
about 5 minutes of your timeCreate an OAuth client in Google Cloud
In console.cloud.google.com, create (or pick) a project, then go to APIs & Services → Credentials → Create credentials → OAuth client ID, type Web application. If Google asks you to configure the consent screen first, choose External and fill in just the app name and your email — defaults are fine for everything else.
console.cloud.google.com → APIs & Services → Credentials → OAuth client ID (Web application)
Add the authorised redirect URI — exactly
In the OAuth client's settings, add this as an authorised redirect URI, character for character. https, no trailing slash.
https://rankbull.io/api/analytics/callback/google
Enable the two APIs
In APIs & Services → Library, search for and enable both the Google Search Console API and the Google Analytics Data API — in the same project as your OAuth client.
Library → "Google Search Console API" → Enable · "Google Analytics Data API" → Enable
Put the two values into your Convex dashboard
Open dashboard.convex.dev, pick your RankBull project (Production deployment), then Settings → Environment Variables. Add GOOGLE_CLIENT_ID with your client ID (ends in .apps.googleusercontent.com) and GOOGLE_CLIENT_SECRET with the secret (starts with GOCSPX-). Exact names, no quotes, no spaces. No restart needed — it takes effect immediately.
GOOGLE_CLIENT_ID · GOOGLE_CLIENT_SECRET
Connect
Back in RankBull, refresh Settings → Analytics — the "not configured" notice disappears. Click Connect Google and approve access with the Google account that owns your Search Console and GA4. Data starts syncing on its own from there.
Questions & troubleshooting
Google says "access blocked" or "access_denied" when I click Connect.
Your OAuth consent screen is in Testing mode (which is fine) but your Google account isn't on its test-user list. In Google Cloud → OAuth consent screen, add your own email as a Test user and connect again.
Google says redirect_uri_mismatch.
The redirect URI in your OAuth client doesn't exactly match https://rankbull.io/api/analytics/callback/google — the usual culprits are http instead of https, a trailing slash, or a typo. Fix it in the OAuth client settings; changes apply within a few minutes.
Connecting works but data errors mention an API not being enabled.
One of the two APIs isn't enabled in the same project as your OAuth client. In APIs & Services → Library, enable Google Search Console API and Google Analytics Data API, then try again.
Why this setup instead of a normal "Sign in with Google" button?
Because the connection runs through your own Google project: tokens land in your own database, and your Search Console and GA4 data never passes through RankBull's servers. Five minutes once, in exchange for your traffic data staying entirely yours.
One payment. Your infrastructure. Every update included.
Everything you just read is the whole setup — there is no hidden part.