Retrieve marketing data with an AI agent: GSC, GA4, and Google Ads

The Search Console example comes from our own Hermes installation at Voltti. It is a historical report reproduced from the Dutch article, not a new measurement. We do not present GA4 or Google Ads as tested Voltti integrations here. If you still need the agent itself, see our Hermes desktop and terminal installation guide or the official Hermes website.

Create a service account in Google Cloud

A service account is an identity for software rather than a person. It does not gain access to your marketing accounts simply because you created it in Google Cloud. You must enable the relevant API and grant access inside each Google product. A Cloud IAM role, a product role, and an OAuth scope do different jobs; none replaces the others.

You can ask Hermes to prepare the connection in your existing workspace. A separate Hermes profile is not required for this task. Keep the request short and start with one source:

Install gcloud and connect Google Search Console for [MY_WEBSITE] using a service account. Add its email in GSC through browser control, or give me the email to add myself. Use read-only access, ask me to approve permissions, and test the connection.

Hermes can inspect the setup, prepare commands, and use an available browser to help with configuration. You handle Google sign-in, 2FA, and consent, and approve the project, property, and access changes. Never give the agent your password or ask it to bypass a login check. Browser access does not remove these human steps. Review the result rather than assuming the setup succeeded.

For a manual setup, or to review what the agent proposes, use these steps:

• Select an existing Google Cloud project or create one you are authorized to use. If command-line setup is useful, install the gcloud CLI. The runtime service account does not need broad Owner or Editor access to your Cloud project just to read marketing reports.

• Under IAM & Admin, create a dedicated service account. If a JSON key is necessary for your local setup and your organization permits it, create one and store it securely. Prefer a supported keyless method when available; do not weaken an organization policy that blocks key creation.

• Enable the Search Console API. Enable the Analytics Data API and Google Ads API only when you are ready to configure those sources. Enabling an API does not itself grant access to a property or Ads account.

• Have a property owner add the service account email under Search Console Settings > Users and permissions. Use the lowest permission level that supports the reports you need, never ownership for routine reporting. Configure the connector to request the webmasters.readonly scope.

• For a connector that uses Application Default Credentials, set GOOGLE_APPLICATION_CREDENTIALS to the JSON file path in the environment of the process that makes the API requests. Confirm the active identity and property with a small read request before scheduling reports.

The Search Console authorization documentation distinguishes webmasters.readonly from the read/write webmasters scope. A restricted prompt is not an access control. Use an appropriately restricted product role, a read-only connector, and an explicit property allowlist. Review inherited access as well as direct grants.

The Application Default Credentials documentation explains how Google libraries locate credentials. GOOGLE_APPLICATION_CREDENTIALS is a file pointer, not an API permission or a universal Hermes setting. It does not automatically switch the active gcloud CLI account. Your connector must support this authentication method and request the appropriate scopes.

Keep the JSON key out of chat, source control, screenshots, and ordinary shared backups. Restrict file access to the process account; on Linux or macOS, permissions such as 0700 for the directory and 0600 for the file are a useful baseline. Restart the relevant process if it needs to pick up a changed environment. Do not print the key to prove that it works.

At Voltti, the documented setup uses a dedicated identity with read-only Search Console access. This article does not claim billing access or working GA4/Ads access for that identity. Our page on AI security and privacy explains the same least-privilege approach.

A historical Search Console report

Ask for an exact property and date range. For example, type this into Hermes after the connection has been verified:

Retrieve the Search Console report for voltti.ai for June 1 through August 31, 2026. Show totals and top queries, and flag missing data or reporting limits.

The panel below is an English translation of the historical report already published in the Dutch article. Query strings and numeric values are preserved; decimal notation is localized. This translation is not a fresh API run, and the original excerpt does not record the search type, row limit, or final/provisional data setting.

What the agent does with the data: from numbers to actions

The historical example reports 240 impressions and 7 clicks across June–August 2026. The brand query has a 75% CTR, but that comes from just 8 impressions. Broader queries have impressions without clicks. These are observations from a small dataset, not evidence that a particular content change will increase traffic.

The original agent recommendation was to address the query "ai agent of chatbot" with relevant content and internal links. Before creating anything, check whether a suitable page already exists. A translation should not turn an old recommendation into a new execution claim, or encourage a duplicate page. Our article on SEO with an AI agent covers the wider review workflow.

For a new report, ask the agent to retain the exact property, dates, dimensions, filters, and data status alongside its recommendations. Query rows may not add up to property totals because of reporting limits and privacy filtering. Compare the export with the Google interface using matching settings before acting on it.

Extend the setup to Google Analytics 4

For GA4, enable the Analytics Data API and add the service account email to the property through Admin > Property access management. Viewer access is sufficient for standard reporting; use the numeric GA4 property ID, not the G- measurement ID. The connector must authenticate with analytics.readonly and call the Data API. Google’s Analytics API quickstart documents the client-library and runReport approach.

Once access is verified, a short request is enough:

Show sessions by channel for the last 30 complete days in our GA4 property. Include the date range and property ID, and list the top landing pages separately.

State the actual start and end dates in the report and retain the property time zone. Check metric and dimension compatibility rather than assuming any two columns can be combined. Channel sessions and landing-page sessions are separate report views; they should not be joined row by row.

An earlier version of this article used invented values to illustrate the GA4 report layout; those values have been removed. The GA4 section is setup guidance rather than a measured report: the documented Voltti example does not include a verified GA4 run.

Google Ads: more requirements than GSC or GA4

Google Ads supports direct service-account access. An Ads administrator adds the service account email under Admin > Access and security, as described in Google’s service account workflow. Select Read-only access for reporting and check access inherited through manager accounts. You do not need to impersonate a human user for the documented direct-access flow.

You also need a developer token from the API Center of a Google Ads manager account. Test Account Access only supports test accounts. Explorer Access, Basic Access, and Standard Access can support production accounts, subject to their limits and permitted features. Check the actual level and permissible use in Google’s access-level documentation; a token existing is not proof that production reporting is authorized.

Google Ads uses the adwords OAuth scope, not a separate read-only OAuth scope. Restrict access through the Ads account role and the connector’s allowed reporting methods. Configure the developer token, target customer ID, and, when accessing through a manager account, the appropriate login-customer-id. The Ads client library may require its own key-file setting; setting GOOGLE_APPLICATION_CREDENTIALS alone is not a complete Ads configuration.

Add Ads after the first reporting connection works, then verify GA4 separately if you need it. Technically, Ads does not depend on either source. Working incrementally makes it easier to find a wrong account ID, missing role, or token restriction. Do not turn an authorization error into an instruction to grant administrator access.

After the Ads connection has passed a read test, you can ask:

Report clicks and cost by campaign for the last full month in the Ads account I confirmed. Use reporting calls only, and show the account currency and exact dates.

Combining sources can help you investigate which campaigns bring useful visits, but Search Console impressions, Analytics sessions, and Ads clicks measure different things. Match the date range, time zones, account currency, and attribution assumptions. An agent should explain those differences rather than present them as interchangeable totals.

For example, a business using Moneybird could compare campaign statistics with invoices available through its API for the same period. This is a possible workflow, not a customer result. Attributing revenue to a campaign requires a reliable link between the campaign, customer, and invoice; matching dates alone does not establish attribution. Our guide to connecting AI to a CRM or CMS covers the integration approach.

A service account versus your own Google account

Do not share your Google password. User OAuth is a legitimate alternative to a service account: it can also use limited scopes and revocable consent. The comparison is about who owns the automated access and how you manage it, not a claim that all user authentication gives unlimited access.