Connecting Google

A single Google login authorizes four products at once; there's no way to grant partial access.

• One OAuth connection covers YouTube (analytics, plus optional upload/manage), Google Analytics 4, Search Console, and Google Ads, all approved at once on Google's consent screen.
• The scopes requested are youtube.upload, youtube.readonly, yt-analytics.readonly, analytics.readonly, webmasters.readonly, and adwords.
• Every one of these is read access only, with the single exception of the YouTube upload scope, which additionally lets BrandOps upload or manage videos on your behalf if you choose to use that.
• There's one connected Google account per brand; connecting a different account replaces whichever one was connected before.

Each product feeds a specific part of BrandOps once it's connected.

• Google Analytics 4: sessions, active users, and page views for a selected date range, a daily trend, and a top-5 country/city breakdown by sessions. This is what feeds GA4 numbers wherever BrandOps shows website traffic.
• Search Console: total clicks, impressions, and average CTR for your site over a period, a daily trend, and your top 5 search queries by clicks. This is the data behind the Search Console card in Brand Hub's Analytics panel (the "GSC Striking Distance" tab inside Keyword Finder is separate, illustrative sample data for now, not wired to this connection).
• Google Ads: campaign-level spend, clicks, impressions, conversions, and ROAS, as both daily totals and a per-campaign breakdown. This one needs an extra step after connecting (see below).
• YouTube: channel analytics, and optionally video upload/management if you use that part of the scope.

What actually happens when you click Connect Google.

• Click Connect Google in Settings → Integrations. You'll see a single Google permission screen listing YouTube, Analytics, Search Console, and Ads; approve all of it in one go.
• After the popup closes, BrandOps fetches your available YouTube channels, GA4 properties, and Search Console sites and lets you pick which ones to use for this brand.
• Google Ads needs one more step: paste your Ads Customer ID (the 10-digit number shown top-right when you're logged into Google Ads) into the Google Ads panel underneath the main Google card. Campaign queries won't run without it.
• BrandOps requests offline, consent-prompted access, which lets it refresh your token silently in the background; you don't have to re-approve access every hour.

What happens as your access token ages, and when you'll actually need to step in.

• Google access tokens are short-lived (about an hour) and refresh automatically in the background; you won't see anything change on your end as long as refreshing keeps working.
• The "Reconnect required" state in Settings only appears after an actual refresh attempt has failed, for example if you revoked BrandOps's access from your Google Account settings, not just because the short-lived token happens to be due for renewal. So if you see it, it means something real needs attention, not routine expiry.
• A Google Ads call that fails with an authorization error is treated as a scope problem specifically. You'll be told to reconnect Google to make sure the Ads scope is included, since all four products are approved together on the original consent screen.

What BrandOps can and can't do with this connection.

• Every one of these connections is read access only, aside from YouTube's optional upload/manage capability. BrandOps never edits or deletes anything in your Analytics, Search Console, or Ads account.
• Disconnect any time from Settings → Integrations. Disconnecting stops new data from syncing in; anything already pulled into BrandOps stays in your history.
• Use the Google account that actually has access to the properties you want. A personal Gmail account won't surface anything if your properties live under a company Google Workspace account instead.