Google connection problems

Summary#

Google connection failures land in four groups: the connection never starts, the consent screen hands back an error, the connection succeeds but no properties are found, or a connection that worked has stopped being accepted. Each group has its own message, and this article gives you the wording for all of them so you can identify which one you have without guessing. Every quoted string is exactly what appears on screen.

Symptoms#

You are trying to use Google Search Console data and one of these is happening.

Before you reach Google

• The Google Search Console + Analytics card shows a Setup required badge and the Connect Google button is not there.
• Pressing Connect Google shows plain text: Google OAuth is not yet configured. Set GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET in Cloudflare Pages env vars.
• Pressing Connect Google shows Missing ?email=<your-email> parameter.
• Pressing Connect Google shows Could not start the Google connection, please retry.

At Google, or on the way back

• Google shows a warning screen about an unverified app.
• You land on a page headed Connection failed with one of: Google denied the connection: access_denied, Invalid or expired connection request. Please start again., OAuth flow expired (> 10 min). Try connecting again., Server missing OAuth credentials., or Token exchange failed: redirect_uri_mismatch.
• You get plain text Missing code or state.

After connecting

• The badge says Connected, but a Domain Overview result says You're connected to Google, but example.com isn't one of your verified GSC properties (0 found).
• The same message but with a non-zero count, naming a domain you expected to be covered.
• The panel shows GSC error: followed by a message.
• The panel sits on Loading real Google Search Console data… and does not finish.
• Numbers appear but are older than what Search Console shows.

Diagnosis#

Work out which stage failed#

The stage tells you the cause faster than the wording does.

The connection never starts#

Setup required on the badge and the plain-text Google OAuth is not yet configured. Set GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET in Cloudflare Pages env vars. are the same fact stated two ways: Google sign-in is not configured for this site. Nothing in your account causes it and nothing in your account fixes it. Report it.

Missing ?email=<your-email> parameter means the connection started without knowing who you are. In practice this is an old or hand-edited link, or a session that ended while the page was open. Reload the dashboard, confirm you are signed in, and press Connect Google from the Integrations screen rather than from a saved link. If the dashboard cannot see your session at all, press Connect Google and you will get Please sign in first. instead.

Could not start the Google connection, please retry. means the request could not be recorded. It is transient. Try once more, and report it if it repeats.

The handshake failed#

No properties are found#

This is the most common report, and (0 found) and (4 found) mean different things.

(0 found) means Metric Vault could not read a single property. There are three reasons, in order of likelihood:

1. The connection is no longer accepted. Access was revoked at Google, the Google password changed, or the grant was removed by a Workspace administrator. The connection record still exists here, so the badge still says Connected, but nothing can be read with it.
2. The Google account has no Search Console properties. Signing in with a personal address when the properties live on a work address does this. The badge on the Integrations card shows which account is linked.
3. The property exists but that account was never granted access to it. Being able to see a site in Google Analytics, or owning the domain, is not the same as having Search Console access to it.

A non-zero count means the connection works and the domain did not match. Metric Vault compares the domain you analyzed against the property list, ignoring http://, https://, a trailing slash and a leading www., and it understands domain properties written as sc-domain:example.com. Subdomains match their parent and parents match subdomain properties.

So a mismatch usually means one of:

• The property is registered for a different domain entirely, for example the .co.uk when you analyzed the .com.
• The property was added to Search Console after you connected but the account you connected with was not given access to it.
• You analyzed a full page address rather than a domain.

Working in a teammate's workspace produces this too. Google connections are personal. If the workspace owner connected Google and you did not, the card can report a connection while your own reports find no properties. Connect your own Google account. See What teammates share.

A connection that used to work#

Google access tokens are short-lived and Metric Vault renews them automatically the next time it needs data. Renewal only fails when the grant behind it is gone. When it does, the panel reports it as GSC error: followed by one of:

Anything else after GSC error: came from Google itself and is passed through unchanged, for example a quota message.

The panel never finishes loading#

Loading real Google Search Console data… that stays put means the request to Google did not come back. Reload the page and run the report again. If it persists across a reload and a different browser, report it.

The numbers look stale#

Two delays are normal and neither is a fault. Search Console data lags by about two days, which is why the range ends three days back. On top of that, Metric Vault reuses your Search Console result for one hour. A change made in the last hour will not be visible yet. See Result caching and freshness for how caching works across the product.

Resolution#

1. Read the badge on the Google card first. Setup required means stop and report it. Not connected means connect. Connected means the problem is further down.
2. Confirm which Google account is linked. If it is the wrong one, press Connect Google and choose the right account. The new connection replaces the old one, so there is nothing to remove first.
3. Connect once, in one tab, in one sitting. Most handshake errors are a second tab or a delay past 10 minutes.
4. For (0 found), reconnect. Open Integrations, press Connect Google, and approve the consent screen again. This issues a fresh grant and fixes every revoked-access case.
5. For a domain mismatch, check Search Console. Open Google Search Console with the same account and confirm the property is listed there. If it is not, verify it, or ask its owner to grant your account access. A property you cannot open in Search Console cannot be read here.
6. Analyze the domain, not a page. Enter example.com rather than https://example.com/blog/post-title.
7. Wait out the cache. If you have just changed something and expect it to show, give it up to an hour.
8. If you want to end the access entirely, remove Metric Vault at myaccount.google.com/permissions. See Disconnecting an integration.
9. Still stuck? Contact us with the exact message, the domain you analyzed, and which Google account you connected. See Contacting support.

Prevention#

• Connect with the account that owns the Search Console access. Deciding this before you press the button avoids most of the problems on this page.
• Add new properties to the account you already connected. A property added under a different Google account will not appear here.
• Do not open the connect flow in two tabs. The request is single-use by design, so the second tab always fails.
• Reconnect after any Google security change. A password reset, a revoked app grant or an administrator policy change all end the grant. Reconnecting takes under a minute.
• Expect the two-day lag. Judge freshness against Search Console's own latest complete day, not against yesterday.
• Each teammate connects their own Google account. Do not assume the workspace owner's connection covers the team.