How to revoke a third-party app's access to your Google data

From the SoleOS answers series — written about our own product space; grounded in published definitions and documented behavior, never invented numbers.

Go to myaccount.google.com/connections, find the app in the list, click it, and select "Delete all connections." That single page controls every third-party OAuth grant on your Google account, regardless of which Google product the app was reading — GA4, Search Console, Play Console, Gmail, whatever. Revoking there is immediate and doesn't require the app's cooperation.

That's the whole answer for most people. The rest of this post covers the parts that trip founders up: confirming the revoke actually worked, cleaning up service-account access (which doesn't show up on that page), and what happens to a tool like SoleOS once you cut the cord.

Where Google actually stores these permissions

Google has three separate places where "access" can live, and only one of them is the connections page:

1. OAuth app connections — third-party apps and dashboards that you signed in with "Continue with Google" or explicitly authorized to read GA4, Search Console, Play Console, or Drive data. These live at myaccount.google.com/connections.
2. Service account access at the resource level — if a tool asked you to add a service account email (something ending in @project-id.iam.gserviceaccount.com) as a user in GA4 property settings, Search Console, or Play Console, that grant is not revoked by the connections page. You have to remove it inside GA4 Admin, Search Console's Users and Permissions, or Play Console's Users and Permissions, respectively.
3. API keys — Bing Webmaster and some other tools use a flat API key rather than Google's OAuth flow, so revoking is done by regenerating the key on the provider's side, not through Google at all.

Most connector setup guides tell you which of these three a tool uses. If you don't remember, check the account settings inside the app you're trying to disconnect — it usually says whether it used OAuth or a service account.

Step 1: Revoke the OAuth grant

1. Sign in at myaccount.google.com/connections.
2. Scroll or search for the app name.
3. Click into it and review exactly what scopes it requested — this page shows the actual permission list, not a marketing summary, so it's worth reading even if you're not planning to revoke.
4. Click "Delete all connections."

This kills the refresh token Google issued to that app. Any access token it's currently holding will stop working the next time it tries to use it — typically within the hour, since Google access tokens are short-lived and get refreshed constantly.

Step 2: Check property-level and console-level access

If the tool ever asked you to paste in a service account email rather than click "Sign in with Google," go remove that email directly:

• GA4: Admin → Property Access Management → find the service account or user → remove.
• Search Console: Settings → Users and permissions → remove the user.
• Play Console: Users and permissions → find the account → revoke access.

This step matters because a lot of founders assume the Google connections page is a universal kill switch. It isn't. If you granted a service account read access to a GA4 property two years ago and later revoke an unrelated OAuth connection, that service account keeps reading data indefinitely until you remove it at the property level.

Step 3: Confirm the access is gone

Don't just trust the UI — verify. If the tool has a "last synced" timestamp in its own dashboard, watch that it stops updating. If it's a service you built yourself or a script, try re-running the sync manually and confirm it now fails with a 401 or invalid_grant error. For anything pulling GA4 or Search Console data on a schedule, give it one full sync cycle (usually 24 hours) before you consider the revoke fully confirmed.

If you're revoking because you're worried about a leak rather than just cleaning up unused connections, also rotate anything downstream — API keys stored in the disconnected app, webhooks it may have registered, and any exported data it already pulled. Revoking access stops future reads; it doesn't recall data already synced.

Why founders end up doing this

Two common triggers: you tried a metrics dashboard, decided it wasn't worth the subscription, and want to clean up; or you're doing a periodic access audit because you're running several apps and lost track of what's connected to what. Both are good reasons, and neither should take more than five minutes per app once you know where to look.

If you're setting up a new connection and want to avoid this cleanup later, the fix is to be deliberate about scopes at grant time — read-only where it's offered, and one property/account at a time rather than "all properties" if the OAuth consent screen gives you that choice. We wrote a companion piece on how to give a tool access to your Search Console data with the exact scope-selection screen, and a similar one for sharing GA4 data with a dashboard, read-only.

Where SoleOS fits (disclosure)

SoleOS is portfolio intelligence for multi-product founders, built by a solo founder — this is our own blog, so treat this section as us describing our own product, not a neutral review. SoleOS connects to GA4 and Search Console using either OAuth or a service account, whichever you prefer, and only reads aggregated metrics for the properties you explicitly authorize — never raw event data, and never anything outside the scopes you grant. You can see the exact scope list per connector on what SoleOS connects to, and the broader approach on our security overview.

If you disconnect SoleOS the same way described above (Google connections page, or removing the service account from the property), all future syncing stops immediately. We don't cache credentials outside that grant, and we don't retain raw data pulls beyond what's needed to compute the metrics you see in the dashboard.

One honest caveat: if you only run one or two products and check Google Analytics and Search Console directly a couple of times a month, you don't need a portfolio tool connected to your Google account at all — the native dashboards are fine for that, and every extra OAuth grant is one more thing to eventually revoke. SoleOS earns its place when you're checking metrics across 5+ properties regularly and want them next to Stripe/RevenueCat numbers in one place — see tracking Stripe and RevenueCat together for that side of the picture.

Frequently asked questions

Does revoking access on the Google connections page delete data the app already collected?

No. Revoking stops future access to your Google account; it has no effect on data the app already synced and stored on its own servers. If you want that data deleted too, you need to contact the app directly (most legitimate SaaS tools have a data-deletion process in their settings or privacy policy).

How long does it take for revoked access to actually stop working?

The OAuth grant itself is dead instantly — the app can no longer get new access tokens. But if it already has a valid access token cached, that token can keep working until it expires, which for Google is typically under an hour. Give it a few hours to be safe.

I don't remember granting this app access. Should I be worried?

Not necessarily — some apps get authorized during onboarding flows you clicked through quickly, or by a teammate using a shared Google Workspace account. Click into the connection and check the scopes and grant date before assuming anything malicious. If the scopes look broader than the app should need (e.g., full Drive access for something that's supposed to read Search Console), that's worth investigating and revoking regardless.

Can an app keep reading my data through a service account even after I revoke OAuth access?

Yes, if it was set up that way. Service accounts are a completely separate mechanism from OAuth consent — they're added as a "user" directly inside GA4, Search Console, or Play Console, and removing them requires going into that specific product's permissions settings, not the Google connections page.

What's the difference between revoking access and changing my Google password?

Changing your password kills every session and OAuth grant tied to your account, which is a much blunter tool — it'll also log you out of your own devices. Revoking a specific app's connection only affects that one app and leaves everything else untouched, so it's the right move for routine cleanup rather than a suspected account compromise.