Retrieve marketing data with an AI agent: GSC, GA4, and Google Ads

New to Hermes? Start with our Hermes desktop and terminal installation guide or the official Hermes website. Read Hermes Agent explained for what it does once it runs.

In short: grant the service account access in each Google product separately. Enforce read-only access with the product role and the connector, not with the prompt. For Google Ads, you also need a Cloud project with Explorer access to read a live account.

How do you create a service account in Google Cloud?

A service account is an identity for software instead of a person. You create it in Google Cloud, enable the relevant API, and then grant it access inside each Google product. Creating it alone does not give it access to your marketing accounts.

Keep three layers apart. A Cloud IAM role, a product role, and an OAuth scope do different jobs. None replaces the others.

You can ask Hermes to prepare the connection in your existing workspace. You do not need a separate Hermes profile for this task. Keep the request short and start with one source:

Install gcloud and connect Google Search Console for [MY_WEBSITE] using a service account. Add its email in GSC through browser control, or give me the email to add myself. Use read-only access, ask me to approve permissions, and test the connection.

Hermes can inspect the setup, prepare commands, and use an available browser to help with configuration. You handle Google sign-in, 2FA, and consent, and approve the project, property, and access changes. Never give the agent your password or ask it to bypass a login check. Browser access does not remove these human steps. Then check the result yourself; do not assume the setup worked.

At a client, Hermes Desktop carried out the full setup from a similar request. The agent installed gcloud, created a Google Cloud project and the service account, and enabled the APIs. It then used the browser to add the service account with read-only access in Search Console, Google Analytics, and Google Ads. Everything worked right away. The people at the client followed along and checked the permissions afterward.

Step-by-step manual setup

For a manual setup, or to review what the agent proposes, use these steps:

1. Select an existing Google Cloud project or create one you are authorized to use. If command-line setup is useful, install the gcloud CLI. The service account does not need broad Owner or Editor access to your Cloud project just to read marketing reports.

2. Under IAM & Admin, create a dedicated service account. Need a JSON key for your local setup? Create one only if your organization permits it, and store it securely. Prefer a supported keyless method when available. Do not weaken an organization policy that blocks key creation.

3. Enable the Search Console API. Enable the Analytics Data API and Google Ads API only when you are ready to configure those sources. Enabling an API does not itself grant access to a property or Ads account.

4. Have a property owner add the service account email in Search Console under Settings > Users and permissions. Use the lowest permission level that supports the reports you need, never ownership for routine reporting. Configure the connector to request the webmasters.readonly scope.

5. Set GOOGLE_APPLICATION_CREDENTIALS to the JSON file path if your connector uses Application Default Credentials. Set it in the environment of the process that makes the API requests. Then confirm the active identity and property with one small read request before you schedule reports.

How do you limit permissions and protect the JSON key?

The Search Console authorization documentation distinguishes webmasters.readonly from the read/write webmasters scope. A restricted prompt is not an access control. Use an appropriately restricted product role, a read-only connector, and an explicit property allowlist. Review inherited access as well as direct grants.

The Application Default Credentials documentation explains how Google libraries locate credentials. GOOGLE_APPLICATION_CREDENTIALS is a file pointer, not an API permission or a universal Hermes setting. It does not automatically switch the active gcloud CLI account. Your connector must support this authentication method and request the appropriate scopes.

Keep the JSON key out of chat, source control, screenshots, and ordinary shared backups. Restrict file access to the process account. On Linux or macOS, permissions such as 0700 for the directory and 0600 for the file are a useful baseline. Restart the relevant process if it needs to pick up a changed environment. Do not print the key to prove that it works.

How does Hermes reach Google?

Hermes reaches Google through a connector. That is a script or small program that holds the credentials and offers a few reports on your marketing data. That connector is often an MCP server. Hermes can connect to MCP servers, and you can filter which of a server’s tools the agent sees. Choose or build a connector that only offers read actions for the properties you allow.

For GA4 and Google Ads, Google publishes its own MCP server. The Google Analytics MCP server uses the Admin API and the Data API and only offers read tools. You enable both APIs and give the service account at least the Viewer role on the property. About the Google Ads MCP server, Google writes: “The Google Ads MCP server gives your AI client read-only access to live account data.” That server also needs a Cloud project with at least Explorer access.

For Search Console, you usually use a community server or build one yourself. Check which tools such a server offers and which scope it requests before you connect it. Filter out the tools in Hermes that can change anything. That way the connector decides what the agent can do, not just the prompt.

At Voltti, a dedicated service account reads Search Console with read-only access. Since October 2026, the same service account also reads our own Google Ads account. The Search Console example is the only integration this article documents with real output. Our page on AI security and privacy explains the same least-privilege approach.

Example: retrieving marketing data from Search Console

This example comes from our own Hermes installation at Voltti. It is a historical report, not a new measurement. Ask for an exact property and date range. For example, type this into Hermes after you have verified the connection:

Retrieve the Search Console report for voltti.ai for June 1 through August 31, 2026. Show totals and top queries, and flag missing data or reporting limits.

The panel below is an English translation of the historical report published in the Dutch article. Query strings and numeric values are preserved; only the decimal notation is localized. The original excerpt does not record the search type, row limit, or final/provisional data setting.

What does the agent do with your marketing data?

It turns a report into a decision you can review. It lists what it sees, flags data limits, and proposes one action to check.

The historical example reports 240 impressions and 7 clicks across June–August 2026. The brand query has a 75% CTR, but that comes from just 8 impressions. Broader queries have impressions without clicks. These are observations from a small dataset, not evidence that a particular content change will increase traffic.

The original agent recommendation was to address the query "ai agent of chatbot" with relevant content and internal links. Before creating anything, check whether a suitable page already exists. A translation should not turn an old recommendation into a new execution claim, or encourage a duplicate page. Our article on SEO with an AI agent covers the wider review workflow. Whether AI search engines can also quote such a page is a separate check; read how to make your pages citable for AI search.

For a new report, ask the agent to retain the exact property, dates, dimensions, filters, and data status alongside its recommendations. Query rows may not add up to property totals because of reporting limits and privacy filtering. Compare the export with the Google interface using matching settings before acting on it. If you work in a team, any colleague can request such a report in a shared channel (see Hermes for teams).

How do you extend the setup to Google Analytics 4?

For GA4, enable the Analytics Data API and add the service account to the property as a Viewer. Use the numeric GA4 property ID, not the G- measurement ID.

You add the service account email through Admin > Property access management. The connector must authenticate with analytics.readonly and call the Data API. Google’s Analytics API quickstart documents the client-library and runReport approach.

Once you have verified access, a short request is enough:

Show sessions by channel for the last 30 complete days in our GA4 property. Include the date range and property ID, and list the top landing pages separately.

State the actual start and end dates in the report and retain the property time zone. Check metric and dimension compatibility instead of assuming any two columns can be combined. Channel sessions and landing-page sessions are separate report views; they should not be joined row by row.

An earlier version of this article used invented values to illustrate the GA4 report layout; those values have been removed. The GA4 section is setup guidance, not a measured report: Voltti itself does not use a GA4 connection.

What else do you need for Google Ads?

Google Ads needs more than Search Console or GA4. Your Cloud project needs at least Explorer access to read a live account. The service account also needs a role in the Ads account, and you configure the right customer ID.

Google Ads supports direct service-account access. An Ads administrator adds the service account email under Admin > Access and security, as described in Google’s service account workflow. Select Read-only access for reporting and check access that a manager account passes down. You do not need to impersonate a human user for the documented direct-access flow.

API access is managed per Google Cloud project. In September 2026, Google wrote on its Ads Developer Blog: “We are sunsetting developer tokens.” You now sign up for the Google Ads API in the Google Cloud Console, without a manager account. A new project starts with Test access, which only reaches test accounts. To read a live account, apply for Explorer access or higher on the Google Ads API Overview page. Check the limits and permitted features in Google’s access-level documentation.

Google Ads uses the adwords OAuth scope, not a separate read-only OAuth scope. Restrict access through the Ads account role and the connector’s allowed reporting methods. Configure the target customer ID and, when you access the account through a manager account, the appropriate login-customer-id. The Ads client library may need its own key-file setting; setting GOOGLE_APPLICATION_CREDENTIALS alone is not a complete Ads configuration.

Add Ads after the first reporting connection works, then verify GA4 separately if you need it. Technically, Ads does not depend on either source. Working incrementally makes it easier to find a wrong account ID, missing role, or access-level restriction. Do not turn an authorization error into an instruction to grant administrator access.

Four errors come up often. A GA4 request fails when you use the G- measurement ID instead of the numeric property ID. Any source returns a permission error when the service account was never added in the product itself. An Ads call to a live account fails when your project only has Test access. In version v25 of the API, the error is CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION; older versions return ACTION_NOT_PERMITTED. The fix is to apply for Explorer access. Through a manager account, a missing or wrong login-customer-id also blocks the request.

Once the Ads connection passes a read test, ask:

Report clicks and cost by campaign for the last full month in the Ads account I confirmed. Use reporting calls only, and show the account currency and exact dates.

Combining sources can show which campaigns bring useful visits. But Search Console impressions, Analytics sessions, and Ads clicks measure different things. Match the date range, time zones, account currency, and attribution assumptions. An agent should explain those differences, not present them as interchangeable totals. In this setup, the agent retrieves each source itself, so you do not paste exports into a chat window. To see which tool fits which task, read Hermes vs ChatGPT and Copilot.

For example, a business using Moneybird could compare campaign statistics with invoices available through its API for the same period. This is a possible workflow, not a customer result. Attributing revenue to a campaign needs a reliable link between the campaign, customer, and invoice; matching dates alone does not establish attribution. Our guide to connecting AI to a CRM or CMS covers the integration approach.

Service account or your own Google account?

Do not share your Google password. User OAuth is a legitimate alternative to a service account: it can also use limited scopes and revocable consent. The comparison is about who owns the automated access and how you manage it. It does not claim that all user authentication gives unlimited access.