How to get a Google Analytics API key

Google Analytics is different: no quick key

You might have been expecting to repeat what happened with your other tools: click a menu, generate a key, copy it, email it over, done. Google doesn't work that way, and this guide explains why.

Google protects private data (like your Analytics reports) with its own account system. A simple "API key" in Google's world is only used for public information, not for anything belonging to you. Instead, Google asks you to create something it calls a service account: a special, empty "robot user" that lives in Google's system, which you then invite into your Analytics property the same way you'd invite a human colleague.

Think of it like hiring a cleaner. You don't hand over your own house keys and your alarm code. Instead you issue the cleaner their own key, which only opens the front door, and you can cancel it without ever changing your own locks. A service account is the cleaner, the JSON file is their key, and you still control the door.

The dashboard connection ends up just as automatic: no expiry, no re-login, and you can revoke access whenever you want. But it does involve Google's developer console, which is a bit more involved than the other services. The steps below walk through everything on screen, one click at a time.

What you'll end up sending us: a downloaded file called something like xenium-dashboard-1234abc.json, and a 9-digit number called your Property ID. That's it. Everything else is for us to wire up.

What you need before you start

• Access to your Google Analytics (the same Google account you normally open analytics.google.com with).
• Admin (or Editor) rights on that Analytics property. You'll need them to add the service account as a user later in this guide. If you're not sure, whoever set up Analytics for you can grant you access, or they can sit next to you for step five.
• A Google Cloud project. Think of it as a workspace box for all the "plumbing" (keys and settings) that Google tools use. If you have never made one, step two covers it in a few clicks.
• Roughly 20 minutes. Most of that is Google's own loading screens and waiting periods. Nothing here costs money.

A quick note on terms: your Analytics data is organised into a property, usually one per website. If your business has one website, you almost certainly have one property, and this guide works for it.

Step-by-step: getting what we need

Step 1: Find your Property ID

1. Go to analytics.google.com and sign in with your usual Google account.
2. Click the cog (⚙ Admin) button at the bottom left.
3. Under the Property column, click Property details. Your Property ID is the number at the top, something like 327741967.

This number tells the dashboard which website's data to read. There is a separate "stream ID" and other numbers in Analytics; ignore those, the Property ID is the one we want.

Write it down or copy it now. It goes in the email you send us at the end.

Step 2: Set up your Google Cloud project

This is the part other tools don't need, and it's why Google's process looks scary. Don't worry: you won't ever need to type a single command.

1. Go to console.cloud.google.com in your browser (same Google account).
2. At the very top, next to the Google Cloud logo, there is a project picker. Click it.
3. If you have no projects yet, click New Project (top right).
4. Name the project something memorable: xenium-dashboard works well.
5. Google shows you a billing account screen or "free trial" offer. You don't need to pay or add any card. The free tier covers everything in this guide.
6. Click Create. After a moment, Google sets the project as active in the top bar.

Step 3: Turn on the Google Analytics Data API

1. In the Cloud console, open the menu (three lines, top left).
2. Click APIs & Services, then Library.
3. Search for Google Analytics Data API.
4. Click it, then click Enable if it isn't already on.

That's the whole "turn the feature on" step. No projects or complicated settings needed.

Step 4: Create the service account

1. In the Cloud console menu, go to IAM & Admin > Service Accounts.
2. Click Create service account (or + Create service account at the top).
3. In the Service account name field, type something meaningful: xenium-dashboard is fine.
4. The Service account ID fills itself in. Leave it alone.
5. Click Create and continue, then on the roles screen click Continue (no roles are needed here), then Done.

You're now looking at the Service accounts list, with your robot user sitting there. It can't do anything yet; it has no key and no access to your data. Two more steps.

Step 5: Give the service account read access to your Analytics

1. On the Service accounts page, click the new entry. You'll see an e-mail like xenium-dashboard@xenium-dashboard.iam.gserviceaccount.com. Copy that e-mail address (click the copy icon next to it).
2. Go back to analytics.google.com.
3. Click the Admin button again (bottom left).
4. Under the Property column, click Property access management.
5. Click the + (plus) in the top right, then Add users.
6. Paste the service account's e-mail address in the e-mail box.
7. Uncheck Notify new users (so nothing goes to the robot; it has no inbox).
8. Tick Viewer under the roles list. Don't tick anything else, Viewer is all it needs.
9. Click Add.

You have just given the robot user permission to read your Analytics data. From here, anything holding that JSON key can see your reports (but nothing else).

Step 6: Create and download the JSON key

1. Back in the Cloud console, under IAM & Admin > Service Accounts, click the e-mail of the service account you just made.
2. Click the Keys tab along the top.
3. Click Add key > Create new key.
4. Leave JSON selected, then click Create.
5. A file downloads. It's called something like xenium-dashboard-1234ab.iam.gserviceaccount.com.json.

Step 7: Send it over

Email us the JSON file and the Property ID number. That is all we need. Once we have it, your dashboard pulls your Google Analytics numbers automatically, the way the other services already do.

Short-step recap

1. Analytics: Admin > Property details, copy the Property ID.
2. Cloud console: create project xenium-dashboard.
3. Enable the Google Analytics Data API in APIs & Services > Library.
4. IAM & Admin > Service Accounts > Create service account, copy its e-mail.
5. Analytics: Admin > Property access management, add that e-mail as Viewer.
6. Cloud console: service account > Keys > Add key > Create new key > JSON, download.
7. Email the file and the Property ID.

Troubleshooting

"I got to the Cloud console and it wants to charge me"

The free tier covers everything in this guide; you should never be asked for more than Google's standard free-trial page. If you see a paid plan screen, click "Dismiss" or "Back". Nothing in this guide creates a cost.

"Enable is greyed out / API not found"

Make sure the project you selected at the top is the one you created in step two. Google Cloud can silently switch to a different project if you have more than one.

"Analytics won't let me click Admin"

You only have Viewer (or Analyst) rights on the property. Ask whoever manages your Analytics to either run step five with you on a call, or add you as an Editor temporarily. You can be dropped back down afterwards.

"The data isn't updating in my dashboard"

Google Analytics reports run on a delay, usually a few hours, sometimes up to a full day. If the dashboard shows numbers up to yesterday, that is normal Google behaviour, not a fault.

"I lost the JSON file"

No drama: the same "Add key > Create new key > JSON" button gives you a fresh one whenever you need it. If the lost file was never shared with anyone else, nothing to worry about. If in doubt, create a new key and delete the old one from the Keys tab so it can never be used again.

"I want to stop sharing this with you"

Broken trust shouldn't be a technical problem. Two options: in Analytics > Access management, remove the service account user. Or in the Cloud console, on the service account's Keys tab, delete the key. Both cut off access instantly.

What we do with your key

Only two things: wire up the connection (a one-time job at setup) and run the automated fetches on schedule. We never paste your token anywhere user-facing, we never commit it to public code, and only you or we can read your data once it's set up this way. If a token is ever compromised you'll be told, and the fix is a 1-click revoke plus a new token.

Why this matters

That service account is the last piece standing between you and a dashboard that updates itself. Once it's connected, your Analytics figures refresh on their own, alongside your other data, with no logins, no copy-pasting, and no expiry dates to set a calendar reminder for.

Frequently asked questions

Why not just an API key like the other tools?

Google uses credential types called "API keys" only for data that's public anyway. Anything personal (your reports, your users' private information) needs proper authentication: a service account or an OAuth login flow. For a dashboard, the service account approach is the right one, because it doesn't need anyone's password.

Does this cost anything?

No. The Google Analytics Data API is free up to very generous limits (well beyond what one dashboard needs). The Cloud project itself is free tier; no card required for any of these steps.

Can I give it to you in a different way than email?

Email is fine for the first send: the file is specific to this one dashboard. If you'd rather not email it, we can do a short screen-share call and paste it directly on your side, just ask.

Will this keep working when I change my Google password?

Yes. That's the advantage of a service account, it is tied to a JSON key, not your personal login. Password changes, two-factor changes, even losing your phone don't break the dashboard connection.

What if Google changes something?

The service stays supported by Google, and we keep our dashboard code updated for any changes Google makes, so you don't need to keep pace with that, same as with the other guides.