Skip to main content

Google Analytics Admin API MCP server

Use this integration when an AI agent should configure and govern Google Analytics 4 (GA4): accounts and properties, data streams, conversion and key events, custom definitions, Google Ads and Firebase links, measurement protocol secrets, access reports, and related admin operations. The Admin API is complementary to the Google Analytics Data API, which covers reporting and audience export queries.

Setting up an MCP server

This article covers the standard steps for creating an MCP server in AI Gateway and connecting it to an AI client. The steps are the same for every integration — application-specific details (API credentials, OAuth endpoints, and scopes) are covered in the individual application pages.

Before you begin​

You'll need:

  • Access to AI Gateway with permission to create MCP servers
  • API credentials for the application you're connecting (see the relevant application page for what to collect)

Create an MCP server​

Find the API in the catalog​

  1. Sign in to AI Gateway and select MCP Servers from the left navigation.
  2. Select New MCP Server.
  3. Search for the application you want to connect, then select it from the catalog.

Configure the server​

  1. Enter a Name for your server — something descriptive that identifies both the application and its purpose.
  2. Enter a Description so your team knows what the server is for.
  3. Set the Timeout value. 30 seconds works for most APIs; increase to 60 seconds for APIs that return large payloads.
  4. Toggle Production mode on if this server will be used in a live workflow.
  5. Select Next.

Configure authentication​

Enter the authentication details for the application. This varies by service — see the Authentication section of the relevant application page for the specific credentials, OAuth URLs, and scopes to use.

Configure security​

  1. Set any Rate limits appropriate for your use case and the API's own limits.
  2. Enable Logging if you want AI Gateway to record requests and responses for auditing.
  3. Select Next.

Deploy​

Review the summary, then select Deploy. AI Gateway provisions the server and provides a server URL you'll use when configuring your AI client.

Connect to an AI client​

Once your server is deployed, you'll need to add it to the AI client your team uses. Select your client for setup instructions:

Tips​

  • You can create multiple MCP servers for the same application — for example, a read-only server for reporting agents and a read-write server for automation workflows.
  • If you're unsure which OAuth scopes to request, start with the minimum read-only set and add write scopes only when needed. Most application pages include scope recommendations.
  • You can edit a server's name, description, timeout, and security settings after deployment without redeploying.

How this differs from Analytics “user management” in the Help Center​

The Help Center article [UA] Add, edit, and delete users and user groups [Legacy] describes Universal Analytics (legacy) and who can sign in to the Analytics product UI—adding people by email, roles, and groups. That is not the same as enabling programmatic access via Google Cloud.

  • UI access (people): Use GA4 Admin → Property / Account access management in the product, and follow current GA4 documentation for user and group management (the linked article explicitly points readers to GA4 resources for equivalent workflows).
  • API access (applications and agents): Use Google Cloud (project, enabled APIs, OAuth client or service account) and the Google Analytics Admin API as described below.

Enabling the Admin API in Google Cloud​

Complete these steps in the same Google Cloud project where you create OAuth credentials (or the project attached to your service account).

  1. Select or create a Google Cloud project
    In Google Cloud Console, pick the project that will own OAuth credentials (or service account keys) for your MCP integration.

  2. Enable the Google Analytics Admin API
    Open APIs & Services → Library, search for Google Analytics Admin API, and click Enable.
    Direct link pattern: https://console.cloud.google.com/apis/library/analyticsadmin.googleapis.com?project=YOUR_PROJECT_ID

  3. Configure the OAuth consent screen (for user-delegated OAuth)
    Under APIs & Services → OAuth consent screen, choose User type (Internal or External), add an app name, and add any Google Analytics Admin API scopes your integration will request (see Authentication below). Publish the app if required for users outside a Google Workspace test org.

  4. Create OAuth 2.0 credentials
    Under APIs & Services → Credentials, create an OAuth client ID of type Web application. Add the AI Gateway outbound redirect URI (see your tenant’s auth documentation—typically https://auth.aigateway.cequence.ai/v1/outbound/oauth/callback or the value your administrator provides).

  5. Link Cloud to Analytics (conceptual)
    GA4 properties and accounts live in Google Analytics; your GCP project only hosts credentials that call the Admin API on behalf of a user or workload. Ensure the Google account used for OAuth has the right roles in the GA4 Admin UI (for example Administrator on the account or property) for the operations you automate.

  6. Optional: Service accounts
    Some server-only flows use a service account with appropriate access to a GA resource; product behavior and supported flows change over time—verify against Google’s Admin API authentication documentation.

Official references: Admin API overview, REST reference (v1beta).

Authentication​

The Admin API uses OAuth 2.0 with Google’s standard endpoints. Request only the scopes your workflow needs.

ValueSetting
Auth endpointhttps://accounts.google.com/o/oauth2/v2/auth
Token endpointhttps://oauth2.googleapis.com/token
Scopes (typical)https://www.googleapis.com/auth/analytics.edit, https://www.googleapis.com/auth/analytics.readonly
  • Use analytics.readonly for list/get and reporting-adjacent admin reads where writes are not required.
  • Use analytics.edit when the agent must create or update properties, streams, links, conversion events, or secrets.

Available tools​

Tools reflect the Google Analytics Admin API v1beta REST surface (exact tool names depend on the catalog version deployed in your AI Gateway). Common groups include:

AreaExamples
Accounts & summariesList accounts, list account summaries, provision account tickets, search change history
PropertiesList and create properties; acknowledge user data collection where required by the product
Data streams & secretsList/create data streams; list/create/patch/delete measurement protocol secrets
Definitions & eventsCustom dimensions and metrics; conversion events and key events; archive custom metrics
LinksFirebase links; Google Ads links
Access & auditRun access reports (administrator-only in Google’s model)

Tips​

Separate Admin and Data MCP servers when you want least privilege: read-only admin for inventory, and Data API read-only for reporting.

Resource names are stable identifiers—use accounts/{id}, properties/{id}, and full child resource paths as returned by list APIs instead of guessing numeric IDs from the UI alone.

Acknowledgement flows—some property operations require explicit acknowledgement of user data collection terms before secrets can be created; model that in automation to avoid opaque 400 errors.

Change history and access reports may require Administrator privileges in GA4 and correct OAuth scopes; handle permission errors explicitly in agents.

See also: Google Analytics Data API for runReport, realtime, pivot, batch, and audience export tools.