How integrations work

Summary#

Every integration in Metric Vault uses OAuth, the standard "sign in with" flow. You are sent to Google, LinkedIn, X or Meta, you approve a named list of permissions on their screen, and they hand Metric Vault an access token for your account. You never type an outside password into Metric Vault, and you can withdraw the access at the other company at any time. This article explains the model once so the individual connection articles do not have to repeat it.

Purpose#

Metric Vault can tell you a great deal about a website from public data alone. Two things it cannot do without your permission are read your own measured search performance and post to your own social accounts. Both require the other company to trust that you asked for it, and OAuth is how that trust is expressed.

The model exists so that granting access is explicit, scoped and reversible. Explicit, because you see the permission list before you agree. Scoped, because the request names exactly what it wants rather than asking for your whole account. Reversible, because the grant lives at the other company and you can end it there without our involvement.

Overview#

There are two families of connection, and they behave slightly differently.

Google is a data connection. Once connected, Metric Vault can read your Search Console figures for the properties that Google account already has access to. It is read-only. It cannot change anything in your Google account. See Google Search Console.

Social channels are publishing connections. Once connected, Metric Vault can post on your behalf to the channel you approved. Six are supported: LinkedIn, X, Facebook, Instagram, TikTok and Threads. See Connecting social accounts.

Neither family costs credits, and neither is restricted by plan. What is restricted is availability: a channel only appears as connectable if the underlying app credentials are configured for this site. A channel without them shows Setup needed and its Connect button is replaced by that label, because starting a flow that cannot finish would waste your time.

Both families are managed from Integrations in the sidebar, under Account & Team. Social channels can also be managed from Social Dashboard under Promote, which is where the full list, the composer and the schedule live.

How it works#

The connect flow, step by step#

1. You press Connect Google or Connect on a channel.
2. Metric Vault creates a one-time connection request tied to your email address, stores it, and redirects you to the provider.
3. The provider shows you its own consent screen with the permission list.
4. You approve or decline.
5. The provider sends you back to Metric Vault with a temporary code.
6. Metric Vault checks that the code arrived with a connection request it created, exchanges the code for an access token, reads your display name or email from the provider so the connection can be labelled, and saves it.
7. You see a confirmation page and return to the dashboard.

Google opens in the same browser tab and ends on a page titled Google connected! with a Back to Dashboard link. Social channels open in a 600 by 720 popup window and end on a page titled <Channel> connected, which closes itself after a moment and tells the dashboard to refresh the channel list.

The connection request is single-use and short-lived#

The request created in step 2 is deleted the moment it is used, so a connection link can never be replayed, and it expires on a timer. Google's window is 10 minutes; social channels get 15 minutes. If you start a connection, wander off, and come back later, you will see OAuth flow expired (> 10 min). Try connecting again. for Google or The connection flow expired (over 15 minutes). Please start again. for a channel. Neither is a fault. Press Connect again.

Opening the same connection in two tabs has the same effect: the first tab to finish consumes the request, and the second gets This connection link is invalid or was already used. Please start again.

Where the access is kept#

Access tokens are stored in Metric Vault's own database, on the server. They are never sent back to your browser and they are never included in any response the app reads. The list of connected channels that the dashboard displays contains the account name, handle, avatar and connection date, and deliberately leaves the token out.

The connection is filed under the email address you were signed in with when you made it. Google allows one connected Google account per Metric Vault account, so connecting a second one replaces the first. Social channels allow more than one account per platform.

Access expires, and some of it renews#

Google issues a short-lived access token plus a long-lived refresh token. Metric Vault refreshes the access token automatically the next time it needs data, so a working Google connection keeps working without you doing anything.

Social channels are different: automatic renewal is not implemented for them yet. When a social token stops being accepted, publishing to that channel fails with a message naming the fix, for example Your LinkedIn connection has expired. Reconnect LinkedIn and try again. The remedy is to press Disconnect and then Connect again on that channel. Other channels are unaffected.

What a teammate sees#

Connections are made per person, not per workspace. If you are working inside a teammate's workspace, their Google connection is not yours to use, and your own social channels are not shared with them. Each person who wants live Search Console data connects their own Google account. See What teammates share for what is genuinely shared.

Disconnecting#

Disconnecting removes the stored token from Metric Vault. It does not sign you out of the other service and does not delete anything you already published.

• Google. Removing the connection also clears the Search Console figures cached for your account, so panels immediately go back to estimates.
• Social. Removing a channel leaves posts already published in place. A post still sitting in the schedule for that channel will fail when its time comes, because there is no longer a connection to send it with. Cancel scheduled posts before you disconnect the channel they target.

Disconnecting inside Metric Vault does not revoke the grant at the provider. To end it at the source, remove Metric Vault at myaccount.google.com/permissions for Google, or in the connected-apps section of the platform for a social channel. Doing that first is also fine: the stored token simply stops being accepted, and the next attempt to use it reports the failure.

Full steps are in Disconnecting an integration.

What breaks if it is misconfigured#

Almost every integration failure is one of three things, and each one names itself on screen:

None of these are caused by anything in your account, and none are fixed by reconnecting. Report them and they are corrected on our side.