H.I.V.E. — Setup Guide

How to Connect Google Search Console & Analytics

A real, verified walkthrough — every screen, every exact button label, and the specific mistakes worth avoiding. Written by actually doing it, not guessed from memory.

⏱ ~10 minutes 💵 Free 🧩 14 steps
Before you start
Part 1 — Turn on the right Google services
1
Open Google Cloud Console
Go to console.cloud.google.com and sign in. If you already have a project (check the button near the top-left, next to the Google Cloud logo — it might already say something like "My First Project"), you can use that one. No need to create a new one unless you want a fresh start.
2
Open APIs & Services
Click the ☰ menu icon in the top-left corner. In the sidebar that opens, click "APIs & Services."
3
Enable three specific APIs
Click "Library" in the left sidebar. Search for and enable each of these, one at a time — search its name, click the matching card, then click the blue "Enable" button:
• Google Search Console API — only one result comes up, it's the right one.
• Google Analytics Data API — the one you want specifically. See the warning below.
• Google Analytics Admin API — usually sits right in the same search results as the one above.
Watch out: searching "Analytics Data API" brings up close to 20 similar-sounding results — Google Analytics API, Analytics Admin API, Analytics Hub API, and more. The one you want is named exactly "Google Analytics Data API", described as "Accesses report data in Google Analytics." You'll know each one worked when its detail page shows Status: Enabled.
Part 2 — Tell Google what your app looks like
4
Open the consent screen setup
In the left sidebar, click "OAuth consent screen" — Google may label this "Google Auth Platform" instead; they're the same thing, just renamed. If it says "not configured yet," click "Get started."
5
Fill in your app's basic info
Enter an App name (whatever people should see when they click "Connect") and a User support email (pick your own email from the dropdown). Click Next.
6
Choose "External" as your audience
Not "Internal" — that option only works for Google Workspace business accounts and would block basically everyone else from ever connecting. External is the one that lets any Google account connect. Click Next.
7
Confirm and create
Enter your email again under Contact Information, click Next, check the agreement box, then click Create.
Part 3 — Create your actual sign-in credentials
8
Start creating an OAuth client
You'll land on an overview page with a "Create OAuth client" button — click it.
9
Choose "Web application"
For Application type, select "Web application." This is the one that actually generates a Client Secret — other types don't.
10
Verify your real callback address first
Before typing anything into the form, open a new tab and visit your own site with /gsc-callback.html added to the end (e.g. https://yoursite.com/gsc-callback.html).
What you should see: a plain black page saying "This page should only be opened as part of the connect flow." That confirms the real, correct address. If you get an error instead, that file may live at a different path on your site — track down the real one before continuing. Don't guess this value; it causes a silent failure later if it's wrong.
11
Fill in the two web addresses
Under "Authorized JavaScript origins," click + Add URI and enter your website address with no trailing slash (e.g. https://yoursite.com). Under "Authorized redirect URIs," click + Add URI and enter the exact address you just confirmed in Step 10. Click the blue Create button.
12
Copy your Client ID and Client Secret carefully
A popup shows both values. Click the client's name any time to see them again later.
Watch out: when copying the Client ID, copy only the ID itself — nothing else. Paste it somewhere temporary first (like a plain text note) and check that nothing extra got mixed in before pasting it anywhere permanent. A single stray character breaks the connection silently, with no obvious error pointing back to this step.
Part 4 — Finish the connection
13
Store both values in the right places
The Client ID is safe to enter directly in the app's own Setup page. The Client Secret is the genuinely sensitive one — that only ever goes into your backend's secret storage (for this app, that's a Cloudflare Worker secret named exactly GOOGLE_CLIENT_SECRET), never into the app itself.
14
Confirm it actually works
Back in the app's Setup page, click "Check again." Once both Google-related items show a green checkmark, go try clicking "Connect" for real — that's the moment you'll know everything is genuinely wired together correctly.
That's it — you're connected.
This was a one-time setup. From here forward, it just runs.
← Back to H.I.V.E.