Connect Search Console in about ten minutes.

One Google service account, read-only, added to the properties you choose. No consent screen to publish and no token that expires in a week.

Step 1: Create the service account in Google Cloud

console.cloud.google.com5 min

In any Google Cloud project, enable the Google Search Console API, then create a service account. It needs no IAM role and no access to the Cloud project itself - the only permission that matters is the one you grant in step 2. Create a JSON key on it and download the file.

Step 2: Add the service account to your property, Restricted

search.google.com/search-console2 min

Open the property, then Settings, Users and permissions, Add user. Paste the service account address (it ends in .iam.gserviceaccount.com, and it is the client_email field inside the key file) and choose Restricted. That level can read performance data and nothing else: CrawlSpec asks Google for read-only scope, so it could not write to the property even with a higher grant.

Step 3: Paste the key into CrawlSpec

Settings, Integrations1 min

Paste the whole JSON file into the Google Search Console panel and save. The key is verified on save, encrypted at rest, and never shown again - the panel only ever displays its last four characters. Then open each project, bind the property it belongs to, and the first pull runs from there.

The paste happens at Settings, Integrations inside your workspace, and each project binds its own property under that project's settings.

Common questions

Why a service account instead of signing in with Google?: An unpublished OAuth consent screen expires its refresh tokens every seven days, so a browser sign-in would silently stop refreshing data within a week. A service account added as a property user does not expire.
What can CrawlSpec see?: Search performance for the properties you added the account to: queries, clicks, impressions, CTR and position. The token is issued for read-only scope, so nothing can be submitted, removed or changed in your property.
Who owns the key?: You do. It is your Google Cloud service account, stored encrypted against your workspace, and revoking it is two clicks in either place - remove the user in Search Console, or revoke the credential in CrawlSpec.
What if I skip this?: The crawl, the issue catalog and the fix cards all work without it. Search Console is what ranks that work by the traffic actually at stake, and it is what makes the cannibalization report possible at all.

Stuck on the Google Cloud half, or the property is administered by somebody else? Reply to your welcome email, or write to us and we will do this with you on a call.