Google Analytics

Live

OAUTH 2.0

ANALYTICS

Analytics

Google Analytics gives your agent authenticated access to GA4 reporting, so analytics questions get answered against the properties each user can actually see.

  • Per-user credentials: each call uses the actual user's token, never a shared bot.
  • Encrypted per-tenant vault: AES-256, resolved at request time, never in LLM context.
  • Scoped before every call: pre-call scope check, 90-day SIEM-exportable audit chain.
Google Analytics
agent · Acme Q3
Run
How did organic traffic convert last week?
S
googleanalytics_run_report
140ms
Analytics agent
Organic sessions 24,180, up 12% week over week. 486 conversions at 2.01%, led by /pricing.
Sources: GA4 property 318492065, Aug 4 to Aug 10
googleanalytics
1 report
18:29
Message Claude...

Tools your agent reaches for on Google Analytics, scoped per user.

CALL ANY TOOL
Run GA4 reports, manage custom dimensions and audiences, and read realtime analytics with the signed-in user's own property access.
googleanalytics_accounts_run_access_report
Accounts run access report
Run a Data Access Record Report for a Google Analytics account: an audit log of who accessed report data and when, across every property in the account. Useful for compliance/security reviews. Returns rows broken down by the requested access-report dimensions and metrics (e.g. userEmail, accessCount) over a date range.
Parameters
Name
Type
Required
Description
end_date
string
Required
End of the report date range (YYYY-MM-DD, or relative: today/yesterday/NdaysAgo).
entity
string
Required
The account to run the access report for, in the form accounts/{accountId}.
metrics
array
Required
Access-report metric names, e.g. ["accessCount"]. At least one metric is required. See the Data Access API schema docs for valid names.
start_date
string
Required
Start of the report date range (YYYY-MM-DD, or relative: today/yesterday/NdaysAgo).
dimension_filter
object
Optional
Advanced: a raw FilterExpression object to filter rows by dimension values.
dimensions
array
Optional
Access-report dimension names, e.g. ["userEmail", "propertyId"]. See the Data Access API schema docs for valid names.
limit
integer
Optional
Maximum rows to return. Defaults to 10000; the API returns at most 100000 rows regardless.
offset
integer
Optional
Row offset for pagination. Omit or set to 0 for the first page.
return_entity_quota
boolean
Optional
If true, the response includes this account's current Data Access API quota consumption.
time_zone
string
Optional
IANA time zone (e.g. America/New_York) used to interpret start/end dates. Defaults to the property's time zone if omitted.
googleanalytics_acknowledge_user_data_collection
Acknowledge user data collection
googleanalytics_archive_custom_dimension
Archive custom dimension
googleanalytics_batch_run_reports
Batch run reports
googleanalytics_create_audience_export
Export create audience
googleanalytics_create_custom_dimension
Create custom dimension
googleanalytics_create_data_stream
Create data stream
googleanalytics_create_google_ads_link
Create google ads link
googleanalytics_create_measurement_protocol_secret
Create measurement protocol secret
googleanalytics_delete_account
Delete account
googleanalytics_delete_data_stream
Delete data stream
googleanalytics_delete_google_ads_link
Delete google ads link
googleanalytics_delete_measurement_protocol_secret
Delete measurement protocol secret
googleanalytics_get_account
Get account
googleanalytics_get_conversion_event
Get conversion event
googleanalytics_get_custom_metric
Get custom metric
googleanalytics_get_data_stream
Get data stream
googleanalytics_get_measurement_protocol_secret
Get measurement protocol secret
googleanalytics_list_account_summaries
List account summaries
googleanalytics_list_conversion_events
List conversion events
googleanalytics_list_data_streams
List data streams
googleanalytics_list_key_events
List key events
googleanalytics_query_audience_export
Export query audience
googleanalytics_run_pivot_report
Run pivot report
googleanalytics_search_change_history_events
Search change history events
googleanalytics_update_account
Update account
googleanalytics_update_custom_dimension
Update custom dimension
googleanalytics_update_data_retention_settings
Update data retention settings
googleanalytics_update_google_ads_link
Update google ads link
googleanalytics_update_measurement_protocol_secret
Update measurement protocol secret

For more tools, view docs.

Build your Agent
Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.
Python · LlamaIndex
import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Google Analytics tools scoped to this user
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["googleanalytics"], toolNames: [
    "googleanalytics_accounts_run_access_report",
    "googleanalytics_acknowledge_user_data_collection",
    "googleanalytics_archive_custom_dimension"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Is the Salesforce sync healthy?" }] });
import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["googleanalytics"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "Which data sources are connected?" }],
  tools,
});

// Execute the tool call with the user's vaulted Google Analytics credential
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");
import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["googleanalytics"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Pull open Zendesk tickets created this week." }],
  tools,
});

// Tool call runs with the user's vaulted Google Analytics credential
await sk.tools.executeTool(msg.content, "user_123");
import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["googleanalytics"] }, pageSize: 100,
});

const agent = new Agent({
  name: "googleanalytics_agent",
  model: "gemini-2.5-pro",
  instruction: "Work with Google Analytics for the signed-in user.",
  tools,
});

await agent.run("What auth does the Shopify connector need?");
Try these prompts
Paste any prompt into your agent to get started.
Reporting
Copy the prompt
Copied
Run a traffic report for the last 28 days broken down by channel.
Copy the prompt
Copied
Compare conversions this month against the previous month.
Copy the prompt
Copied
Which landing pages drove the most engaged sessions last week?
Property setup
Copy the prompt
Copied
List every GA4 property I have access to.
Copy the prompt
Copied
Create a custom dimension for signup plan.
Copy the prompt
Copied
Show me the data streams configured on this property.
Audiences
Copy the prompt
Copied
Create an audience export for users who viewed pricing but did not convert.
Copy the prompt
Copied
List the conversion events configured on this property.
Copy the prompt
Copied
Check whether my report dimensions and metrics are compatible.
SEE HOW AUTH WORKS
Your users connect Google Analytics once. Their credentials stay vaulted, every report call is scope checked, and every query is logged.
1
Authorize
Your user connects
Google Analytics
once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access
Who:
user ‘A’
when:
Once per user
access:
Limited to user
2
Store
Their
Google Analytics
token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection
vault:
encrypted
scope:
per-user
tokens:
auto-refreshed
3
Resolve
When your agent calls a
Google Analytics
tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs
speed:
~40ms
check:
before every call
seen by:
nobody
4
Audit
Every
Google Analytics
tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it
history:
90 days
export:
SIEM-ready
logged:
every call
Test other agents
See the same per-user auth pattern across other connectors.
GTM and RevOps Teams
Competitive intelligence briefing agent
Scans Gong calls for competitor mentions, matches each one to its Notion battlecard, and DMs every affected rep a single Slack digest per cycle. Every call runs as the PMM who owns the briefing, never a shared bot.
GTM and RevOps Teams
Revenue forecast commentary
Pulls open pipeline from Salesforce and HubSpot, calculates coverage against quota, flags at-risk stages, posts commentary to Slack, and logs every snapshot to Google Sheets.
GTM and RevOps Teams
Deal intelligence agent
Pulls recent Gong calls, scores deal risk with an LLM, cross-references the record in Attio, and DMs each owner their at-risk deals in Slack. Every read is scoped to that rep's own access.
GTM and RevOps Teams
CRM AI agent
Reads the Granola transcript after every call, extracts next steps and updates the HubSpot record, drafts the follow-up in Gmail, and confirms in Slack, all on the rep's own delegated OAuth.
Test other agents
See the same per-user auth pattern across other connectors.
GTM
Competitive intelligence briefing agent
Scan Gong calls for competitor mentions, match each one to its Notion battlecard, and DM every affected rep a single Slack digest.
GTM
Revenue forecast agent
Score pipeline coverage against quota across Salesforce and HubSpot, post forecast commentary to Slack, log snapshots to Sheets.
SALES
Deal intelligence agent
Score Gong call risk with an LLM, cross-reference the Attio record, and DM each owner their at-risk deals in Slack.
GTM
CRM AI agent
Turn each Granola call transcript into a HubSpot record update, a drafted Gmail follow-up, and a Slack recap.
Why Scalekit
Secure your agent's access. Connectors ship in minutes
01.
Shared tokens break per-user analytics
A shared Google Analytics token looks fine in a demo. In production every action looks like one service account, and you cannot tell who wired a source or ran a query. Scalekit resolves the credential of the actual user who triggered the agent, never a shared bot.
// shared token
audit → bot_service_account

// scalekit
audit → user_abc ✓
02.
Authentication is not authorization
03.
Multi-tenancy is architectural
04.
Google Analytics today. Ten connectors tomorrow.
“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”
Venu Madhav Kattagoni
Head of Engineering / Von
FAQs
Frequently Asked Questions
Does the agent read analytics as the user or through a shared service account?
As the user. Scalekit resolves the credential of the person who triggered the agent, so an agent can only report on the GA4 properties that user already has access to.
What happens when someone loses access to a property?
The next call fails the way it should. Access is evaluated against the user's live Google grant at request time, not against a cached token you have to remember to revoke.
Can I restrict the agent to read-only reporting?
Yes. Scope the connection to the reporting tools and leave the admin tools out. The scope check runs before the API call, not inside a prompt.
How many GA4 tools are available?
66 across reporting, admin, audiences, and realtime. The page shows a representative 30; the full list is in the docs.
Does this work across multiple GA4 properties and tenants?
Yes. Credentials are namespaced per tenant and per user, so one customer's agent can never resolve another customer's Google Analytics token.
Start in your coding agent
Up and running in one command
Install the Scalekit skill in your editor of choice. Connector, auth, tools, prompt, all wired up
Claude Code REPL
/plugin marketplace add scalekit-inc/claude-code-authstack
/plugin install agentkit@scalekit-auth-stack
Cursor Code REPL
# ~/.cursor/mcp.json
{
""mcpServers"": {
""googleanalytics"": {
""url"": ""https://mcp.scalekit.com/googleanalytics"",
""headers"": { ""Authorization"": ""Bearer $SCALEKIT_TOKEN"" }
}
}
}
Codex Code REPL
# ~/.codex/config.toml
[mcp_servers.googleanalytics]
url = ""https://mcp.scalekit.com/googleanalytics""
auth_env = ""SCALEKIT_TOKEN""
Copilot Code REPL
# .vscode/mcp.json
{
""servers"": {
""googleanalytics"": {
""url"": ""https://mcp.scalekit.com/googleanalytics"",
""type"": ""http""
}
}
}