Google Search Console setup guide

Agents read your numbers and run reports.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Google Search Console, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Google Search Console can be connected 2 ways. Where there’s a key or token to paste, that’s usually the quickest.

Google service account

Service account.

1. In Google Cloud console (https://console.cloud.google.com), create or pick a project, open APIs & Services > Library and enable the Google Search Console API.
2. Open IAM & Admin > Service Accounts, create a service account, and on its Keys tab choose Add key > Create new key > JSON. Organizations created on or after May 3, 2024 block key creation by default; an organization admin has to allow it for this project, or use the OAuth option instead.
3. In Search Console (https://search.google.com/search-console), select the property, open Settings > Users and permissions > Add user, enter the service account's email (client_email in the JSON file) and choose Full. Restricted is enough if agents should only read reports and inspect URLs; submitting sitemaps needs Full.
4. Enter the property exactly as Search Console shows it: sc-domain:example.com for a Domain property, or the full address with its trailing slash (https://www.example.com/) for a URL-prefix property. Paste the contents of the JSON file.

Field	What to enter
Service account key (JSON file contents)	A secret: Everdeck saves it encrypted and never shows it again. Where to find it.
Search Console property (sc-domain:example.com or https://www.example.com/)	Text. For example sc-domain:example.com. Where to find it.

The scopes Everdeck asks for:

• https://www.googleapis.com/auth/webmasters

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at Google Search Console until you delete or rotate it there.

Your Google OAuth app

Your OAuth app.

This way signs in with an OAuth app you create for Google Search Console, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

1. In Google Cloud console (https://console.cloud.google.com), create or pick a project, open APIs & Services > Library and enable the Google Search Console API.
2. Open Google Auth platform > Branding and fill in the app name and support email. Under Audience, choose Internal if you use Google Workspace. An External app left in Testing gets refresh tokens that expire after 7 days.
3. Under Data Access, add the scope listed below.
4. Under Clients, choose Create Client > Web application and add the authorized redirect URI https://everdeck.io/api/oauth/callback.
5. Copy the Client ID and Client secret into the form, enter the property (sc-domain:example.com or https://www.example.com/), then sign in with a Google account that is an owner or Full user of that property.

Field	What to enter
Search Console property (sc-domain:example.com or https://www.example.com/)	Text. For example sc-domain:example.com. Where to find it.

The scopes Everdeck asks for:

• https://www.googleapis.com/auth/webmasters

When you disconnect, Everdeck asks Google Search Console to revoke the sign-in, then deletes the tokens it saved.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• List propertiesTier 0 · ReadReads outside contentsearch_console_list_sites

  List the Search Console properties these credentials can see, with the permission level on each (siteOwner, siteFullUser, siteRestrictedUser; siteUnverifiedUser means no access).

• Query search performanceTier 0 · ReadReads outside contentsearch_console_query_search_analytics

  Clicks, impressions, CTR (0 to 1) and average position, grouped by any of query, page, country (ISO 3166-1 alpha-3, for example sgp), device (DESKTOP, MOBILE, TABLET), searchAppearance and date, with optional filters. Dates are YYYY-MM-DD in Pacific Time. Rows are sorted by clicks, or by date when grouped by date; each row's keys follow the order of dimensions.

• Top search queriesTier 0 · ReadReads outside contentsearch_console_get_top_queries

  The searches that showed the site most, ranked by clicks, with impressions, CTR (0 to 1) and average position for a date range (YYYY-MM-DD, Pacific Time).

• Top pages in searchTier 0 · ReadReads outside contentsearch_console_get_top_pages

  The site's pages ranked by clicks from Google Search, with impressions, CTR (0 to 1) and average position for a date range (YYYY-MM-DD, Pacific Time).

• Queries for one pageTier 0 · ReadReads outside contentsearch_console_get_page_queries

  The searches that led to one page (exact URL as Google lists it), ranked by clicks, with impressions, CTR and position. Use it to see what a page ranks for.

• Search performance by dayTier 0 · ReadReads outside contentsearch_console_get_performance_by_date

  Clicks, impressions, CTR and average position for each day in a range, oldest first. With data_state all, metadata.first_incomplete_date marks where numbers may still change.

• Check a page's index statusTier 0 · ReadReads outside contentsearch_console_inspect_url

  Whether Google has indexed a URL (verdict PASS, NEUTRAL meaning excluded, or FAIL), the coverage state, last crawl time, robots.txt and noindex status, Google's chosen canonical versus the page's own, and detected rich results. Reflects the indexed version, not a live test. The URL must belong to the property.

• List sitemapsTier 0 · ReadReads outside contentsearch_console_list_sitemaps

  Sitemaps submitted for the property with when Google last read each one, whether it is still pending, its error and warning counts and how many URLs it lists.

• Submit a sitemapTier 2 · ReversibleReads outside contentsearch_console_submit_sitemap

  Submit (or resubmit) a sitemap so Google reads it again, for example after publishing new pages. The sitemap URL must be on the property's site.

• Remove a sitemapTier 4 · Money or irreversibleReads outside contentsearch_console_delete_sitemap

  Remove a sitemap from the property's sitemap report. Google stops reading it from Search Console; it does not delete the file or remove pages from search.

What can start work

These events from Google Search Console can become tasks for your agents through Intake. How Intake works.

Once a day, clicks, impressions, CTR and position for the last 7 days with complete data, so an agent can report and flag drops.

Connect Google Search Console first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Once a day, the status of submitted sitemaps (errors, warnings, still pending), so an agent can flag problems.

Connect Google Search Console first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Google Search Console later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using Google Search Console, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.