I need to extract Google Analytics data through it's API. However I do not want to generate any account and key manually (the reason is I do not want to let this technical this to be performed by any non-techie person) and want to dump that data for analysis purpose.
In order to use any of Googles APIs they need to know who you are. You as a developer are identified by the project you create on Google Developer console. Once the project is created you can create a number of different types of credentials including Service account credentials and Oauth2 Credentials.
Answer: No there is no way to programmaticlly create service account credentials. Nor is it possible to use the a Google api without first creating a project on Google developer console.
Note: Google Cloud Resource Manager does exist but is very limited in what it allows you to do.
If someone else is going to be running your application to access their Google analytics Data you should idealy be using Oauth2 in your application and not a service account.
Service accounts are designed as way for the developer to grant others access to data owned by the developer in question. They are not really intended for novice users to be creating their own projects on google developer console and generating credentials.
You are basically asking if you can obtain the credentials necessary to query the API via the API. This does not work.
I am also not sure how this would help you. Before you can do any API operations to a Google Analytics account you need to have an authorized user (e.g. a service account) added to your view or property. If you are in a situation where you can add a user programmatically to an account you might as well just read the data you need.
I am looking to make a web based app which creates a monthly report that has Google Analytics information in i.e. organic searches etc. Some clients will have their own Google Analytics accounts and wont be own mine.
I managed to get the OAuth 2 authorization working with my account however it wont work for clients as I needed to get the client_secret.json file from Google Developers website. I have seen a service like cyfe.com which just gets the google login information and outs the Google Analytics information in graphs and such.
Does anyone know how they manage this is possible without getting the client_secret.json file ?
oAuth2 is designed to let you access to users data with their permission, without requiring to access their password.
You should use your own client Id and client secret, these identify your application, not your users ("client" here means client of the API).
You then need to create an interface where users can allow your application to access to their data, from this you'll get an access token, allowing to your application to access to Google Analytics data of your user on their behalf.
Read "Using OAuth 2.0 to Access Google APIs", and identify the scenario that matches to what you want to achieve.
I strongly suggest that you use a library managing the authentication flow, you don't need to reinvent the wheel. Here's a list from Google: Google API Client Libraries.
How can i use gapi.analytics.auth.authorize without button..
I need it for customers, to track visits on their subdomain, and I have my analytics code on page, so they can't use button to authorize, need without it, automatically.
Any example?
Your question isn't very clear it is hard to understand what you mean by Button.
I think you mean that you would like to select data from YOUR Google Analytics account and display it on YOUR website.
To do this you will need to use a service account as apposed to Oauth2 (Oauth2 would popup with a new window requesting access). When you create the service account in the Google developer console take the service account email address. Give it access at the ACCOUNT level in the Google analytics admin section. It must be the account level this will then give the service account access to read your Google analytics data.
Quota: I am not sure what you are extending to do here but remember you can only make 10000 requests per day against your Google Analytics profile. After that you are cut off there is no way to extend this number. So I advice you to save the data in the database someplace you shouldn't request the same data more then once.
Example:
I suggest that you look for an example in what ever programing language you are intending to use. Again your question doesn't state anything about what language you will be using. Hello analytics API might be a good place to start but it depends upon the language the PHP one is way out of date I wouldn't bother with it. Also you cant use a service account with JavaScript so that one is out to.
Update figured out button
Embded api I think I have finally figured out what you mean by button. gapi.analytics.auth.authorize is used in the Google analytics embedded api. Which is JavaScript which it is not possible to use with a Service account. So the final answer to your question is
Answer: You cant remove the button from the Google Analytics Embded api the only way to login with JavaScript is to use Oauth2.
Advice: switch to PHP and use a service account to request data yourself. Or give each of your customers access to your Google analytics so they can login themselves.
I'm writing a Ruby app that accesses the Google Analytics API to pull down some experiment information.
The app connects and authenticates using a Google Service Account via the following function:
def connect
...
##client = Google::APIClient.new(:application_name => 'My Service App',
:application_version => '1.0.0')
key_file = Rails.root.join('config', 'privatekey.p12').to_s
key_secret = 'somesecret'
key = Google::APIClient::PKCS12.load_key(key_file, key_secret)
asserter = Google::APIClient::JWTAsserter.new(
SECRETS[:google_service_account_email],
['https://www.googleapis.com/auth/yt-analytics.readonly',
'https://www.googleapis.com/auth/analytics.readonly'
],
key
)
##client.authorization = asserter.authorize()
...
end
...which authenticates and discovers both APIs without issue.
Using the client against the YouTube Analytics API works without issue. Using the same exact account to access the Analytics API via...
response = ##client.execute({
# 'analytics is the API object retrieved via discover_api()
:api_method => analytics.management.experiments.list,
:parameters => {
'accountId' => 'AAAAAAAA',
'profileId' => 'PPPPPPPP',
'webPropertyId' => 'UA-WWWWWWWW-#'
}
})
Results in a 403 error response:
{"domain":"global","reason":"insufficientPermissions","message":"User does not have sufficient permissions for this account."}
In regards to authorization, I have double-checked the account service#myapp.com:
Has full permissions to the Google Analytics web interface. I logged in using the service#myapp.com account and was able to view the same Experiments I attempted to list.
Has enabled the Analytics API. Within the API Console, I confirmed in the Services section that the Analytics API item is switch to ON. (Just like YouTube Analytics is.)
I am using the appropriate AccountID, ProfileID, and WebPropertyID values. Copied directly from the Google Analytics web interface.
Given that the service account can access at least one API (YouTube Analytics), and the associated account (service#myapp.com) can access the Analytics web interface, there seems to be something wrong with the service account accessing the Analytics API in particular.
Any ideas?
Similar topics:
“Not sufficient permissions” google analytics API service account (NOTE: This error is slightly different than mine)
Analytics blog post, check comments section for 'permissions'
Make sure you give the service account email (something like 1234567890#developer.gserviceaccount.com) permissions to read/write from your GA view.
Admin > View > User Management > "Add permissions for:"
Pick the right id!
In my case I was using the right credentials (account id, account secret -> authorization_code -> access_token) AND had the email permissions set up right but I was using the account id on the Admin > Account settings page and simply adding ga: to the front.
The id you actually need is the table id! (or that's the one that worked for me at least since most people here are mentioning the account id, which didn't work for me.). You can find that one here: https://ga-dev-tools.appspot.com/account-explorer/
And then you can query as
service.get_ga_data(TABLE_ID,'2017-03-25','2017-03-25','ga:users,ga:pageviews')
I found this API to be badly documented overall and the UI was unclear. But maybe that's just me.
If you still see this message after you added your developer email to analytic user.
You may need to add scope to the object, before new Google_Service_Analytics($client);
$client->setScopes("https://www.googleapis.com/auth/plus.login");
I spent whole day trying to solve this!
I also had to go to the developer console and enable the API in order to make it work. Go to the developer console and select your project and enable the API(s) you want to use.
Make sure your are entering the correct table_id
(ie. GetProfiles(oauth_token)
tableid_input = "ga:72848696")
Even after adding the email to the account level in analytics I still had the same permission problem but the following suggestion helped but didn't solve it:
$client->setScopes("https://www.googleapis.com/auth/plus.login");
That didn't work for me but this did:
$client->setScopes("https://www.googleapis.com/auth/analytics");
https:// is now required to authenticate.
If you are new just to let you know 3 Step procedure required
Enable Google Analytics Reporting API then create service email account (OAuth Client ID)
Add and give permission this service email in google console
Add and give permission this service email account in Google analytics tracking -> User management
Make sure you give the service account email (something like 1234567890#developer.gserviceaccount.com) permissions to read/write from your GA view.
Admin > View > User Management > "Add permissions for:"
I got this issue when I try to integrate GA source to metabase.
Metabase requires Oauth clientid and secret. So I create Oauth clientid in GA (If you face an issue which said you need a Guite user to make it internal access, then you need register a new account under workspace).
Then, I solve this issue by adding my google cloud(workspace) account to view user management, not
1234567890#developer.gserviceaccount.com
Just the google cloud login account, I tried with 1234567890#developer.gserviceaccount.com but it doesn't work. The difference for metabase is it ask the oauth id and secret for your google cloud account not service account.
Hope this can help someone face the same situation.
But it is still trick because another GA4 service which don't have any view
How to create view in Google Analytics 4
Still can't solve this issue.
If any one knows it, please comment. Just don't know how to call the api in GA4 since there isn't view at all.
For me, it has been solved when I select the property that was created with enabling "Create a Universal Analytics property" in "Show Advanced Options" section
Other answers are outdated for Google Analytics v4.
There's a different api that one need to enable and use.
https://developers.google.com/analytics/devguides/reporting/data/v1/quickstart-client-libraries
For node.js:
import { BetaAnalyticsDataClient } from "#google-analytics/data";
import { google } from "googleapis";
const auth = new google.auth.GoogleAuth({
credentials: {
client_email: process.env.GOOGLE_CLIENT_EMAIL,
client_id: process.env.GOOGLE_CLIENT_ID,
private_key: process.env.GOOGLE_PRIVATE_KEY,
},
});
const analyticsDataClient = new BetaAnalyticsDataClient({
auth,
});
If someone has more view he should use the view ID.
I need to write to a Google Calendar from data in our datastore (App Engine app).
I want to access via OAuth 2.
Reading is no problem - the calendar is public and I just use the simple API access method.
Writing is a "problem" - obviously I need to authenticate. However, the calendar is owned by the app administrators, and we want to write to the calendar as a background task - no user interaction is required.
I have gone through all Google's documentation, but I feel none the wiser - how can I do a one -time setup for permanent write access to a Google Calendar, via the V3 API?
To make calls on behalf of your App Engine app without user interaction you should make use of the App Identity module:
https://developers.google.com/appengine/docs/python/appidentity/
If you are using the Google API Client Libraries, using the AppAssertionCredentials object will do this automatically for you:
https://developers.google.com/api-client-library/python/guide/google_app_engine#ServiceAccounts
Note the following:
You will probably still need to supply the simple key in order to attribute quota usage to the right project.
The App Identity module won't work during local App Engine development - you will need to deploy into production in order to obtain valid credentials.
You will need to share the calendar you are writing to with the email address associated with the service account for the App Engine app. To find this email address go to the App Engine Administration Console -> "Application settings" and look for the service account email.
Finally, I'm not 100% sure that the Calendar API allows service accounts direct access, but you should give this a try. If that doesn't work for you an alternative may be to generate a refresh token for a real user that has access to the calendar, and look at embedding that into your application - the service account method is preferable, so I would try that first.