How to give a tool access to your Search Console data

From the SoleOS answers series — written about our own product space; grounded in published definitions and documented behavior, never invented numbers.

Google Search Console gives you two ways to grant a third-party tool access to your data: OAuth (you click "sign in with Google" and approve a consent screen) or a service account (you add an email address as a user inside Search Console, and the tool authenticates independently). For most solo founders, OAuth is simpler and revocable in one click; a service account is better when you're connecting many properties at once or automating access without re-authenticating.

Either path uses the official Search Console API, so you're not handing over your Google password to anyone. Here's how each works and what to check before you approve.

Option 1: OAuth (the "sign in with Google" flow)

This is what most dashboards and analytics tools use. You click a "Connect Search Console" button, Google shows a consent screen listing exactly what scope is being requested, and you approve or deny it.

What to look for on that consent screen:

• The scope should be read-only. Search Console's API exposes a read-only scope (webmasters.readonly) that only allows querying performance data — clicks, impressions, queries, pages, countries, devices. There's a separate scope for verifying and managing properties. A tool that only needs your performance data should never ask for the property-management scope.
• The app name and publisher should match who you're actually signing up with. If a tool has a generic or mismatched name on the consent screen, that's worth pausing on.
• You can revoke it anytime from your Google Account permissions page, independent of the tool itself. If a tool disappears or you stop using it, revoking there is faster than trying to find a settings toggle inside the tool.

OAuth also means the connection is tied to your Google identity, not a static credential. If you use 2FA on your Google account (you should), that protection extends to this connection too.

Option 2: Service account (adding a user by email)

A service account is a machine identity with its own email address, usually ending in .iam.gserviceaccount.com. Instead of you clicking through a consent screen, you add that email as a user in Search Console's Settings → Users and permissions, the same way you'd add a colleague.

This route makes sense when:

• You're connecting many properties at once and don't want to click through OAuth for each one.
• The tool's setup instructions specifically ask for a service account email (common for tools built to handle bulk or agency-style access).
• You want access that isn't tied to your personal Google session — useful if you rotate who manages your accounts.

The critical setting here is the permission level you grant when adding the user:

• Full — can add/remove other users, change settings, and see all data. Don't grant this to a third-party tool.
• Restricted — can see performance data (clicks, impressions, queries) but can't add users or change property settings. This is what a read-only dashboard needs.

Always add a service account as Restricted, not Full. There's no legitimate reason for a reporting tool to need the ability to manage your property's users or verification.

What Search Console access actually exposes

Worth knowing before you connect anything: Search Console's API returns aggregated search performance — queries, clicks, impressions, CTR, average position, indexing status. It does not expose anything about your site's backend, your Google account's other services, or personal visitor data. It's one of the lower-risk connectors in that sense, since there's no revenue or user-identity data in scope at all — just how your pages perform in Google's search results.

That said, "low risk" doesn't mean "don't check." Two things worth verifying with any tool you connect:

1. Does it need one property or all of them? If you manage five domains, you should be able to grant access per-property, not blanket access to every site in your Search Console account. Some OAuth flows request all-or-nothing access — read the scope carefully.
2. Can you disconnect a single property without disconnecting everything? If a tool only offers "connect Search Console" as one on/off switch, that's a sign it wasn't built with the multi-project case in mind, which matters more the more sites you run.

Where this fits if you run more than one site

If you're tracking one blog's search performance, a spreadsheet with monthly exports is honestly fine — you don't need a connector for that. The value of connecting Search Console to a tool shows up once you're comparing organic traffic trends across several products and want it sitting next to signups, revenue, or app store data instead of living in a separate tab you forget to open.

That's the use case SoleOS is built for — pulling Search Console alongside Stripe and RevenueCat, GA4, and App Store/Play data into one view across a portfolio, using OAuth or a service account with restricted, read-only scopes. (Disclosure: SoleOS writes about its own space here, so take the framing accordingly.) You can see exactly which scopes each connector requests, and how to revoke them, at what SoleOS connects to, and you don't need an account to look — the live demo uses sample data.

Frequently asked questions

Does connecting Search Console give a tool access to my Google Ads or Analytics data?

No. Search Console's API scope only covers Search Console data. Access to Google Ads, GA4, or other Google products each requires its own separate OAuth scope or service account permission, granted independently. Connecting one doesn't imply access to another.

What's the difference between "Owner" and "Restricted" user in Search Console?

Owner (or Full) can manage other users, verify or remove the property, and see all data. Restricted can only view performance data — no user management, no settings changes. For any external tool, restricted is the correct level; there's rarely a reason to grant Full to something that just needs to read metrics.

Can I connect Search Console without giving up my Google password?

Yes — that's the point of both OAuth and service accounts. Neither requires sharing your Google password. OAuth uses a token scoped to specific permissions that you can revoke anytime; a service account is a separate identity you add as a user, with no access to your personal account at all.

How do I know exactly what data a tool can pull once connected?

Check the scope shown on the OAuth consent screen, or check the permission level if you added a service account. The Search Console read-only scope covers query, page, country, and device-level performance data — nothing beyond what you'd see in the Search Console UI yourself. If you want a place to check what a specific tool requests, look at its connectors or security documentation before connecting — for SoleOS specifically, that's the security overview.

Is it worth connecting Search Console if I only run one or two sites?

Maybe not. If you're just checking search performance for one site a few times a month, the Search Console UI itself is enough — a connector mainly pays off once you want that data sitting alongside revenue and usage metrics from other products, or once checking each site individually starts eating real time. If you're at that point, a 15-minute weekly portfolio review is a reasonable place to start before deciding you need a dedicated tool.