Skip to main content
Every Google connection in Markifact (Google Ads, Google Analytics 4, Search Console, Merchant Center, Business Profile, Tag Manager, Display & Video 360, BigQuery, YouTube and Data Manager) can run under your own Google Cloud app instead of Markifact’s. You create the app once, mint a refresh token for each channel (or one token that covers several), and paste three values into Markifact.
Custom app connections are available on the Team plan. See White-label Connections for the overview.

​
What Every Google Channel Needs

Three values from your own Google Cloud project: Google no longer requires a developer token for Google Ads, so these three values are everything any Google connection needs.
Already have your own OAuth flow? If your systems already authorize users against your Google Cloud app, skip to the channel page and paste the refresh token you already hold. Make sure it was minted with access_type=offline, prompt=consent, and the scope for that channel.

​
Scopes and APIs per Channel

Enable the APIs for every channel you plan to connect, and request the matching scope when you mint the token. You can request several scopes in one go and reuse that single refresh token across channels.

​
Setting Up Your Google Cloud App

1

Enable the APIs

  1. Open Google Cloud Console and select (or create) the project you want to use
  2. Go to APIs & Services > Library
  3. Search for each API from the table above and click Enable
2

Configure the OAuth Consent Screen

  1. Go to APIs & Services > OAuth consent screen
  2. Choose External (or Internal if everyone who will authorize is in your Google Workspace organization)
  3. Enter your app name, support email, and logo. This is the branding your users see when they authorize
  4. Under Scopes, add the scopes for the channels you plan to connect
  5. Publish the app (Publishing status: In production)
Do not leave the app in Testing status. Google issues refresh tokens that expire after 7 days to apps in Testing, so your Markifact connections would stop working after a week. Publishing with sensitive scopes may show an “unverified app” screen to users who authorize; that is fine when only your own team authorizes.
3

Create an OAuth Client

  1. Go to APIs & Services > Credentials
  2. Click Create credentials > OAuth client ID
  3. Application type: Web application
  4. Under Authorized redirect URIs, add:
  1. Click Create and copy the Client ID and Client secret
4

Mint a Refresh Token

  1. Open the OAuth 2.0 Playground
  2. Click the gear icon (top right), tick Use your own OAuth credentials, and paste your Client ID and Client secret
  3. In Step 1, enter the scope(s) for your channel in the input box (separate several scopes with a space) and click Authorize APIs
  4. Sign in with the Google account that has access to the assets you want to manage
  5. In Step 2, click Exchange authorization code for tokens
  6. Copy the Refresh token
Important: Keep this token secure. Anyone holding it, together with your client ID and secret, can act on everything the Google account can access within the granted scopes.
5

Connect in Markifact

Open the channel’s setup page from the table above, or go straight to Connections, click Connect on the channel, select the Custom App (White-label) tab, name the connection and paste the three values. Markifact verifies them with one API call before saving anything.

​
Rotating or Replacing a Token

Add the connection again with the same connection name and the new refresh token. Markifact replaces the stored credentials in place, so workflows and agents bound to the connection keep working.

​
Troubleshooting

Check both values under APIs & Services > Credentials. A client secret that was reset in Google Cloud invalidates the old one.
The most common causes:
  • The token was minted with a different client ID than the one you pasted
  • The OAuth consent screen is still in Testing status, so the token expired after 7 days
  • The user revoked access under Google account permissions
  • The token was minted without prompt=consent, so Google returned no refresh token at all
Mint a new refresh token and add the connection again with the same name.
Repeat the Playground step with the channel’s scope entered in Step 1 before clicking Authorize APIs. Several scopes can be entered at once, separated by a space.
Enable the APIs listed for the channel under APIs & Services > Library in the project that owns your client ID, then try again. It can take a minute to propagate.

White-label Connections

Overview of custom app connections across channels

Connections

How connections, sharing, and privacy work