How to give your AI agents access to Google Analytics 4

An AI agent becomes much more useful when it can answer questions from your real analytics:

Which channels grew in the last 30 days? Which landing pages lost traffic? Did conversion improve with the increase in sessions?

There are two sensible ways to make that possible. You can connect the agent directly to the Google Analytics Data API, or you can put a read-only intelligence layer such as Revinho between the agent and GA4.

The direct route gives you complete control. The Revinho route removes most of the integration work and gives the agent a cleaner business vocabulary from the beginning.

Option one: connect the agent directly to GA4

Google provides an official Analytics Data API for programmatic access to GA4 reporting data. An agent cannot use it simply because you are signed into Google Analytics in a browser. It needs an authenticated application, permission to a specific property, and code that turns questions into valid report requests.

You first need to choose how that application will authenticate.

Service account

A service account works well for a private backend or a single-company internal agent. The broad setup is:

1. Create or select a Google Cloud project.
2. Enable the Google Analytics Data API.
3. Create a service account and configure credentials for your runtime.
4. Add the service account email to the GA4 property with the minimum required read permission.
5. Store the credential outside the repository and outside the agent prompt.

Google’s official Data API quickstart walks through both user-account and service-account authentication.

User OAuth

OAuth is the usual choice when different users need to connect their own Google Analytics properties.

This route requires more application infrastructure:

• Create an OAuth client and consent configuration in Google Cloud.
• Request the read-only Analytics scope.
• Send the user through Google’s consent flow in a browser.
• Verify the returned state value.
• Exchange the authorization code for access and refresh tokens.
• Encrypt the refresh token and refresh access when it expires.
• Handle revoked access and reconnection.

Google recommends using its client libraries for this flow. Its web-server OAuth guide also explains redirect URIs, refresh tokens, secure storage, and consent behavior.

OAuth is the correct foundation for a product used by many customers. It is not a credential you should improvise inside an agent.

Build a narrow GA4 tool for the agent

Once authentication works, your server can call runReport. Every request needs a property ID, date range, and compatible dimensions and metrics.

A minimal HTTP request looks like this:

curl -X POST \
  -H "Authorization: Bearer $GOOGLE_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "dateRanges": [{"startDate": "30daysAgo", "endDate": "yesterday"}],
    "dimensions": [{"name": "sessionDefaultChannelGroup"}],
    "metrics": [
      {"name": "sessions"},
      {"name": "activeUsers"},
      {"name": "keyEvents"}
    ]
  }' \
  "https://analyticsdata.googleapis.com/v1beta/properties/$GA4_PROPERTY_ID:runReport"

Google documents the required request shape and pagination behavior in its runReport guide. Dimensions and metrics must also be valid and mutually compatible; the Data API schema is the source of truth.

Do not give the agent an unrestricted “call any Google endpoint” function. Expose a smaller server-side tool such as:

type AnalyticsQuery = {
  range: "7d" | "30d" | "90d";
  dimension: "channel" | "source" | "landingPage";
  metrics: Array<"sessions" | "users" | "keyEvents">;
};

type AnalyticsResponse = {
  range: AnalyticsQuery["range"];
  dimension: AnalyticsQuery["dimension"];
  rows: Array<{
    value: string;
    metrics: Partial<Record<AnalyticsQuery["metrics"][number], number>>;
  }>;
  rowCount: number;
};

Your tool can map those safe values to GA4 fields, apply row limits, reject unsupported combinations, and return a predictable shape.

The work that starts after the first API call

Getting one report back is only the first layer. A reliable agent integration also has to decide:

• Which GA4 property the user is allowed to query
• How “last 30 days” maps to the property or workspace timezone
• Whether today’s incomplete data should be included
• How to compare equivalent periods
• How to paginate large reports
• How to handle quota errors, token expiry, and retries
• How to normalize URLs, channels, sources, and campaigns
• How much raw data is safe and useful to place in the model context

The agent also needs instructions for interpreting the response. Sessions, users, and key events are different measures. GA4 revenue events are not a substitute for your billing ledger. A simultaneous increase in traffic and revenue is not proof that one caused the other.

If you want that controlled interface without building and maintaining each layer yourself, Revinho provides the same boundary as a ready-to-connect service.

Option two: connect the agent through Revinho

Revinho already connects to GA4 with read-only Google access, imports the reporting history, normalizes it into workspace-scoped data, and turns recurring analysis into stable resources.

To give an agent access:

1. Open your Revinho workspace.
2. Select Setup your agent.
3. Name the connection and create a token.
4. Copy and run the private one-line install command.
5. Ask the agent a business question.

The install command is a generated POSIX shell command, not an npx package or opaque CLI. You can inspect it before running it: it creates a local Revinho skill directory, downloads the hosted SKILL.md with curl, and writes the workspace URL, workspace slug, and private token to connection.env. It applies restrictive file permissions with umask 077 and chmod 600. The command is private because it contains the token, which is shown once and should be treated like any other secret.

Then ask:

Use Revinho to explain what changed in acquisition over the last 30 days.

The skill teaches the agent which read-only resource to use, which date ranges are supported, and how to describe non-deterministic relationships cautiously.

Use Revinho over MCP

MCP, or Model Context Protocol, is an open standard for exposing tools and context to AI applications through a consistent interface. Revinho uses MCP’s Streamable HTTP transport, so compatible agents configure a single HTTP endpoint. The transport can use standard Server-Sent Events (SSE) when the server needs to stream messages, but it does not require a separate legacy SSE endpoint.

For agents that support Streamable HTTP MCP, configure:

https://www.revinho.com/api/mcp

Authenticate with the Revinho workspace token as a bearer token. The server exposes six focused, read-only tools:

• get_overview
• get_growth
• get_funnels
• get_pages
• get_revenue
• get_opportunities

The agent does not need to invent GA4 dimension names or build arbitrary report bodies. It selects a business-level tool and a reporting range such as 7d, 30d, 90d, or mtd.

Revinho marks every MCP tool as read-only, non-destructive, and idempotent. The token is bound to one workspace, and the server verifies that boundary before returning data.

Use Revinho over REST

If your agent or automation can make HTTP requests but does not support MCP, use the same workspace token with Revinho’s REST API:

set -a
. "$HOME/.agents/skills/revinho/connection.env"
set +a

curl --fail --silent --show-error \
  -H "Authorization: Bearer $REVINHO_TOKEN" \
  "$REVINHO_BASE_URL/api/v1/workspaces/$REVINHO_WORKSPACE/growth?range=30d"

Replace growth with overview, funnels, pages, revenue, or opportunities. Revinho returns a stable, normalized response rather than a raw GA4 report matrix.

The REST path is especially useful for:

• Scheduled agent reports
• Coding agents that can run curl
• Internal scripts and automations
• Agent platforms with generic HTTP tools

What the agent gains beyond raw GA4

A direct GA4 connection answers analytics questions. A Revinho connection gives the agent a wider, already-interpreted business context.

The same Revinho MCP or REST connection covers every supported source already connected to the workspace. Alongside normalized GA4 acquisition and page data, the agent can access:

• Search Console queries, impressions, clicks, position, and page opportunities
• Stripe-sourced revenue, MRR, customers, subscriptions, and refunds
• Period comparisons using the workspace timezone
• Deterministic signals with stored evidence
• Attribution provenance in the response; current acquisition and page revenue context is associated

This distinction matters. GA4 might show that organic sessions increased. Revinho can show that revenue also increased during the same period while explicitly labeling the relationship as associated rather than claiming the traffic caused the revenue.

Which approach should you choose?

Build directly on Google’s Data API when you need full control over every request, are prepared to maintain the auth and reporting infrastructure, or are creating a deeply specialized GA4 integration.

Use Revinho when you want your agent to answer useful growth and revenue questions without teaching it OAuth, GA4’s schema, pagination, normalization, and your business definitions.

The shortest version is:

Connect GA4 to Revinho → Setup your agent → Run one command → Ask a question

The agent gets the context. Your Google credentials stay behind a controlled server boundary.