Create External Credentials for Google Analytics (Beta)

To ingest data from Google Analytics to Data 360, set up an external credential.

Before You Begin

Before you begin, complete these steps:

• In Google Cloud Console, enable the Google Analytics Data API and the Google Analytics Admin API.
• Configure an External OAuth consent screen. Add the users who authenticate the connection as test users, or publish the app before using the connection in production.
• Create an OAuth 2.0 client ID with Web application as the application type.
• In Salesforce Setup, create an OAuth provider with OpenID Connect as the provider type. Enter the Google client ID and client secret, and add the Salesforce callback URL to the Google OAuth client's Authorized redirect URIs. The callback URL must match exactly, including whether it has a trailing slash.
• For the OAuth provider default scope, enter https://www.googleapis.com/auth/analytics.readonly. You don't need to add the openid scope.

note: Google refresh tokens issued while the OAuth consent screen is in testing expire after 7 days. Publish the app to production to prevent the connection from requiring weekly reauthentication.

Set Up External Credentials

1. From Setup, in the Quick Find box, enter Named Credentials. Then select Named Credentials (1).

   

2. On the External Credentials tab (2), click New.

   1. Enter a label and name for your external credential. The name can’t contain spaces. You can use underscores.

   2. For Authentication Protocol, select OAuth 2.0.

   3. For Authentication Flow Type, select Browser Flow.

   4. For Authentication Provider, select the provider you created.

   5. Click Save.

3. Add a principal to the external credential.

   1. In the external credentials that you created, under Principals, click New.

   2. Enter the parameter name. You can include spaces.

   3. For Identity Type, select Named Principal.

   4. For Scope, enter https://www.googleapis.com/auth/analytics.readonly refresh_token.

      The refresh_token scope requests offline access so Google returns a refresh token. Without a refresh token, the connection can stop working after the access token expires.

   5. Set the Sequence Number to 1.

   6. Click Save.

4. Authenticate your external credentials.

   1. Under Principals, from the Actions dropdown menu, select Authenticate.

   2. Follow the authentication flow and confirm access permissions.

   3. To connect Data Cloud to Google Analytics click Allow.

      After you authenticate, the status changes to Configured.

5. Define the named credential.

   1. In the Named Credentials Tab, click New. Then enter a label and name. The name can't contain spaces, but you can use underscores.

   2. For the URL, enter https://analytics.googleapis.com.

   3. For external credentials, select the credential that you created.

   4. Click Save.

6. Enable external credential access with a permission set.

   1. From Setup, in the Quick Find box, enter Permission Sets. Then select it.

   2. Create a permission set or select an existing permission set for users who authenticate the external credential.

   3. Under External Credential Principal Access, add the external credential principal that you created.

   4. Assign the permission set to the user who authenticates the external credential.

   5. Click Save.

Troubleshoot Authentication Errors

If authentication displays Problem Logging In, review the ErrorDescription value in the browser URL. The error page doesn't show the detailed Google error.

Next Step

• Set Up a Google Analytics Connection (Beta)