Google

One screen connects your firm to the three Google products a public web lives with: Search Console (how Google sees your site), Analytics (GA4) (who visits) and Tag Manager (how tags are managed). Every id, key and number on this screen belongs to your firm alone.

The whole setup takes about fifteen minutes and is described below exactly, step by step, in the order that works. You need: your site live on its domain, a Google account, and this screen open in a second browser tab.

Part A — Search Console (~3 minutes)

1. Open search.google.com/search-console → Add property.
2. Choose URL prefix (not Domain) and enter your site exactly as it is served, with the trailing slash: https://example.com/ → Continue.

WHY URL prefix: it verifies with an HTML meta tag, which this screen renders for you automatically. A Domain property needs a DNS TXT record instead — it also works (enter sc-domain:example.com as the property below), but the meta tag is one paste. 3. In the verification dialog pick the HTML tag method and copy the whole line, it looks like: <meta name="google-site-verification" content="oXjMfA9k…" /> 4. On this screen, card Search Console → paste it into Verification token → Save. Pasting the whole tag is fine — the content value is extracted. The meta tag now renders on your site's front page immediately: verification is consent-free (a meta tag sets no cookie) and does not need the tags switch. 5. Back in Search Console press Verify. It passes on the first try, because the tag is already live. 6. Still on this screen, fill Property with exactly what you registered — https://example.com/ (or sc-domain:example.com for a Domain property). The reports and the sitemap button need it; it must match the shape Google knows. 7. Sitemap: the card shows your site's sitemap.xml address. Submit it in Search Console by hand (Sitemaps → paste the address), or come back after Part C and press Submit to Search Console — one button, done.

Search Console data appears with roughly a two-day delay — an empty report in the first days is normal, not broken.

Part B — Analytics GA4 (~4 minutes)

1. Open analytics.google.com → Admin (the gear, bottom left) → ＋ Create → Property. Name it after the site, set your time zone and currency → Create.
2. Choose platform Web, enter the site URL, name the stream → Create stream.
3. The stream detail opens. Copy the Measurement ID — it looks like G-XXXXXXXXXX, top right.

1. On the same stream page check that Enhanced measurement is ON (it is by default). The public web is a single-page application — Google's history-change detection is what counts page views as visitors navigate.
2. The Property ID: Admin → Property details, the number top right — or read it from the Analytics URL: …/web/#/p551208843/…, the number after /p.
3. On this screen: card Tags on the web → paste the G-… id into GA4 measurement id, tick Emit the tags on the public web → Save. Then card Search Console → paste the property number into GA4 property id (for reports) → Save.

The tag is now live — but only for consenting visitors (see Consent comes first below). Check it with your own eyes: open your site, accept the cookies, click around — Analytics → Reports → Realtime shows you within seconds. Open an incognito window, do NOT accept, and Realtime stays empty. Both halves are the proof.

Part C — the service account (~5 minutes)

One credential lets the platform manage Search Console, Analytics and Tag Manager for you — the connection test, the reports on this screen, the sitemap button and the assistant's report tools all ride it.

1. Open console.cloud.google.com → project picker (top left) → New project → name it (e.g. mysite-erp) → Create.
2. Menu → APIs & Services → Library. Search and Enable, one by one: - Google Search Console API - Google Analytics Data API - Tag Manager API (optional — only if you use a GTM container)
3. Menu → IAM & Admin → Service accounts → Create service account → name it (e.g. claudia-erp) → Create and continue → skip the roles (none are needed — access is granted inside each Google product, not in Cloud) → Done.
4. Click the new account → tab Keys → Add key → Create new key → JSON. A file downloads.
5. On this screen: card Google API connection → open the downloaded file in a text editor, copy the whole content, paste it into Service-account key (JSON) → Store the key.

1. The card now shows the account's e-mail (claudia-erp@mysite-erp.iam.gserviceaccount.com). Grant it access in each product — this is the half people forget: - Search Console → Settings → Users and permissions → Add user → the e-mail, permission Full. - GA4 → Admin → Property access management → ＋ → the e-mail, role Viewer. - Tag Manager (only if used) → Admin → User management → the e-mail, Read.
2. Press Test connection. Each product answers for itself: green means granted; a refusal carries Google's own words, which name exactly what to grant to whom. A key that reaches Search Console but not GA4 shows one green and one named refusal — unknown is never green.

From this moment the Last 28 days card reads live numbers on every visit (a fresh GA property starts at zero; Search Console lags ~2 days), and the Submit to Search Console button on the sitemap works.

How the tags behave (the rules behind the screen)

One tag, never two

With a Tag Manager container set, the web loads GTM — and GA4 belongs inside the container, as a GTM tag. Without a container, the GA4 tag loads directly. The platform never emits both, because both would count every page view twice. The measurement id stays useful for the reports either way.

Consent comes first

The tags obey the site's cookie consent, strictly:

• Before consent, not one request leaves for Google. The loader is not even injected until the visitor accepts optional cookies.
• The page always declares Consent Mode v2 signals first, everything denied; acceptance grants analytics_storage only. Ad signals stay denied — this integration is analytics, not advertising.
• A visitor who withdraws consent mid-visit is honoured at once: loaded tags are told denied and nothing new loads.
• The consent manager, the /cookies page and its PDF disclose Google automatically on sites where the tags are enabled.

The shop conversion

Once tags run, the order confirmation page reports a deduplicated purchase event (order number, value, currency) — through the dataLayer for GTM containers, through gtag otherwise. Further e-commerce events are a deliberate later slice.

The download event

The download page reports file_download on the button — the file name, its extension, the version and the link. It rides both paths, the public download and the signed-in one, and it is sent through the same one door as the purchase, so a GTM container hears it as a dataLayer event.

Find it in GA4 under Reports → Engagement → Events. Mark it a key event there if you want it counted as a conversion.

Claudia

The assistant carries the same abilities behind the same manage_google permission: reading and setting the ids, testing the connection, the Search Console and GA4 reports, submitting the sitemap. It deliberately cannot touch the credential.

Boundaries written down

• No advertising. Ad consent signals stay denied and ad-vendor hosts are not in the site's Content-Security-Policy. A firm loading ad tags through GTM will see the browser refuse them — that boundary is deliberate, not accidental.
• No GTM/GA editing from here. Google's own UIs manage containers and properties; this screen verifies access and reads results.
• Per firm, always. Ids, key and numbers belong to one organization; another firm's site shows and knows nothing of them.