---
schema_version: "1"
id: f7a122c011c53b5e6be9635f2e24fd1f45db478ba27d8f8cada0d07d42e26700
title: Create External Credentials for Google Analytics (Beta)
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/data-cloud/data-cloud-int/guides/googleanalytics/c360-a-googleanalytics-cred.md
canonical_url: https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-googleanalytics-cred.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 02bcb4a2accfe110567a3e9c5a163213c2cf7b96f0670314211b0012c19a7809
products:
  - Data 360 Integration Guide
  - Data 360 Developer Documentation
---
# Create External Credentials for Google Analytics (Beta)

To ingest data from Google Analytics to Data 360, set up an external credential.

## Before You Begin

Before you begin, complete these steps:

- In Google Cloud Console, enable the **Google Analytics Data API** and the **Google Analytics Admin API**.
- Configure an **External** OAuth consent screen. Add the users who authenticate the connection as test users, or publish the app before using the connection in production.
- Create an OAuth 2.0 client ID with **Web application** as the application type.
- In Salesforce Setup, create an OAuth provider with **OpenID Connect** as the provider type. Enter the Google client ID and client secret, and add the Salesforce callback URL to the Google OAuth client's **Authorized redirect URIs**. The callback URL must match exactly, including whether it has a trailing slash.
- For the OAuth provider default scope, enter `https://www.googleapis.com/auth/analytics.readonly`. You don't need to add the `openid` scope.

**note:** Google refresh tokens issued while the OAuth consent screen is in testing expire after 7 days. Publish the app to production to prevent the connection from requiring weekly reauthentication.

## Set Up External Credentials

1.  From Setup, in the Quick Find box, enter `Named Credentials`. Then select **Named Credentials** (1).

    ![namedcredential definition](https://developer.salesforce.com/media/NamedCred_13Aug2024.png)

2.  On the External Credentials tab (2), click **New**.

    1.  Enter a label and name for your external credential. The name can’t contain spaces. You can use underscores.

    2.  For Authentication Protocol, select **OAuth 2.0**.

    3.  For Authentication Flow Type, select **Browser Flow**.

    4.  For Authentication Provider, select the provider you created.

    5.  Click **Save**.

3.  Add a principal to the external credential.

    1.  In the external credentials that you created, under Principals, click **New**.

    2.  Enter the parameter name. You can include spaces.

    3.  For Identity Type, select **Named Principal**.

    4.  For Scope, enter `https://www.googleapis.com/auth/analytics.readonly refresh_token`.

        The `refresh_token` scope requests offline access so Google returns a refresh token. Without a refresh token, the connection can stop working after the access token expires.

    5.  Set the Sequence Number to `1`.

    6.  Click **Save**.

4.  Authenticate your external credentials.

    1.  Under Principals, from the Actions dropdown menu, select **Authenticate.**

    2.  Follow the authentication flow and confirm access permissions.

    3.  To connect Data Cloud to Google Analytics click **Allow**.

        After you authenticate, the status changes to Configured.

5.  Define the named credential.

    1.  In the Named Credentials Tab, click **New**. Then enter a label and name. The name can't contain spaces, but you can use underscores.

    2.  For the URL, enter `https://analytics.googleapis.com`.

    3.  For external credentials, select the credential that you created.

    4.  Click **Save**.

6.  Enable external credential access with a permission set.

    1.  From Setup, in the Quick Find box, enter `Permission Sets`. Then select it.

    2.  Create a permission set or select an existing permission set for users who authenticate the external credential.

    3.  Under **External Credential Principal Access**, add the external credential principal that you created.

    4.  Assign the permission set to the user who authenticates the external credential.

    5.  Click **Save**.

## Troubleshoot Authentication Errors

If authentication displays **Problem Logging In**, review the `ErrorDescription` value in the browser URL. The error page doesn't show the detailed Google error.

| Error                               | Resolution                                                                                                                                   |
| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `Remote_Error` or `invalid_request` | Verify the OAuth consent screen configuration and the Google client ID and secret.                                                           |
| `redirect_uri_mismatch`             | Add the exact Salesforce callback URL to the Google OAuth client's **Authorized redirect URIs**.                                             |
| `invalid_client`                    | Verify that the client ID and client secret in the Salesforce OAuth provider match the Google OAuth client.                                  |
| `access_denied`                     | Verify that the authenticating Google account is a test user while the OAuth consent screen is in testing, or publish the app to production. |

## Next Step

- [Set Up a Google Analytics Connection (Beta)](https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-set-up-googleanalytics-connection.md)