One Google service account can serve as the API identity for both GA4 properties and Search Console sites, but it does not come with a single permission setting that covers all 21. Each product grants access on its own hierarchy. In GA4, access is granted at the Analytics account level or on individual properties. In Search Console, it is granted on each site property. “Zero dependencies” is only partly achievable: the Analytics and Search Console APIs can be called directly over REST with OAuth 2.0, but whether your code needs no third-party packages depends on what your language’s standard library can do with signing and HTTP.
Where access is actually decided
Before you touch credentials, map each of the 21 properties to the permission system that controls it. The two products do not share a permission model, so a grant in one never reaches the other.
As an Amazon Associate I earn from qualifying purchases.
| Product | Where you grant access | What the grant reaches | What to plan for |
|---|---|---|---|
| GA4, account level | Account access management for the Analytics account | Every property that sits under that account | Broadest grant; appropriate only if common access is acceptable for all child properties |
| GA4, property level | Property access management for a single property | Only that property | Must be repeated for each property; the narrowest option |
| Search Console, site property | Each URL-prefix or domain property | Only the site property it is granted on | Required per site; the service account needs suitable permission on each property it queries |
The title does not say whether the 21 GA4 properties sit under one Analytics account. That single fact decides how many GA4 grants you need. If they share an account, one account-level grant covers them; if they are split across accounts, you need one grant per account. Google’s Analytics account-structure documentation states that an account can contain multiple properties and sets a limit of 2,000 properties per account. That page was reviewed without a visible publication date, so treat the figure as the documented limit at the time of review rather than a dated commitment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Setup steps
- Inventory the properties. For each of the 21 GA4 properties, record the Analytics account ID and property ID. For each Search Console site, record the exact property identifier as it appears in Search Console. URL-prefix properties are addressed by their full URL. Domain properties use the
sc-domain:form, for examplesc-domain:example.com. Mixing these up produces requests against a property the service account was never granted. - Create or select the service account and enable the APIs. Google’s Analytics quickstarts describe service-account authentication, enabling the relevant API for your Google Cloud project, and granting the service account’s email address access to an Analytics property. Enable the Google Analytics APIs and the Search Console API your application calls, not every API in the project.
- Grant GA4 access by account structure. If all 21 properties live under one Analytics account and the same level of access is appropriate for all of them, grant at the account level. Otherwise, grant at each property and give only the role the application needs.
- Grant Search Console access per site. Add the service account’s email to each of the 21 site properties (or the domain property, where a single domain property covers the site). Confirm the permission level matches the operation you intend to run; see the next section.
- Restrict OAuth scopes. Request only the scopes your reads require. For Search Console, the Search Analytics query reference lists
webmasters.readonlyas the scope for read-only query access. For Analytics, use a read-only scope if the application only reports, and request a broader scope only if it writes configuration. - Test each property individually. Run one read request per property and record which ones return data. A failure on one property usually points to a missing grant on that property, not to a problem with the credential.
Search Console permissions in practice
The Search Console API prerequisites state that the calling account must have the appropriate permission on a property before it can call methods on that property. The permission you need depends on the method. A read-only query of Search Analytics data should be requested with the read-only scope above and granted the lowest permission that allows it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Google’s service-account setup guidance for the Indexing API describes adding the service account’s email as a delegated owner of a verified site property. That guidance is specific to the Indexing API. It does not establish that owner permission is required for every Search Console API read. Do not copy owner access into your plan for a reporting job unless a method you call documents that requirement.
What “zero dependencies” actually means
The official material supports direct REST calls to both APIs with OAuth 2.0. It does not establish that a given language can complete the full credential flow with no packages. That flow has several steps, and each one has a different dependency profile:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Building the token request. The service-account flow creates a signed JSON Web Token (JWT) asserting the account’s identity, then exchanges it for an access token. Signing needs RSA with SHA-256 using the service account’s private key.
- Signing. If your language’s standard library includes RSA signing and a JSON encoder, the signing step adds no packages. If it does not, you need a crypto library, which is a dependency even if the API calls themselves are plain HTTP.
- Making calls. Plain HTTPS requests with a bearer token need only the language’s HTTP client. Client libraries are optional; they reduce code but add packages to maintain.
So the accurate claim is narrower than the title: you can avoid client libraries, and you can avoid third-party packages if your language’s standard library covers JWT signing and HTTPS. Verify that for your specific language and runtime before you describe the setup as dependency-free.
The trade-off is maintenance. Direct REST calls leave token refresh, error handling, pagination and quota retries in your code. A client library carries those concerns but adds a package to track and update.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The GA4–Search Console association is separate
GA4 and Search Console can be linked so that reports appear in each other’s interfaces. That link has its own permissions and allows one corresponding property on each side. It is optional, and it does not authorize the service account to make API calls. If you do not plan to use the association, you can ignore it entirely; if you do, you still need the grants described above.
Expect Search Analytics results to be incomplete
Search Console states that Search Analytics results are subject to internal limits and that the API does not guarantee every possible row. Build your reporting on the returned data rather than assuming complete row coverage for every query, and say so in any output you publish. If you need a specific slice that is missing, narrow the date range, dimensions or filters and compare totals across requests.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Troubleshooting access errors
- Data returns for some properties but not others. The grant is missing on the failing properties. Check each property’s access list against your inventory.
- A GA4 property is missing even though its account has a grant. The property is likely in a different Analytics account than the one you granted.
- Search Console returns a permission error for a domain property you can see in the interface. Confirm the identifier uses the
sc-domain:form and that the grant was made on the domain property, not on a URL-prefix property for the same site. - Authentication succeeds but calls fail. Confirm the API is enabled in the Google Cloud project that issued the credential, and that the scope in the token request matches the operation.
Sources for these steps are Google Analytics Help (account structure and the Analytics quickstarts), the Search Console API documentation (prerequisites and the Search Analytics query reference), and Google’s Indexing API service-account guidance. The Analytics account-structure page reviewed for this article did not show a publication year, so check its current version before you rely on the 2,000-property limit for planning.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
