Connect GA4

Find the property id

• It is that plain number you want, not the G-XXXX measurement id from Data streams. The measurement id is the single most common mix-up on this connector.

1. Open Google Analytics and open the correct GA4 property.
2. Click Admin (bottom-left cog), then under Property settings open Property → Property details. The id is top-right of the Property details card, labelled PROPERTY ID with a copy icon beside it: a plain number, nine digits or so.

Create the service account

1. Open the Google Cloud Console. If this business already has a project from Google Ads setup, use that one rather than creating another.
2. In APIs & Services → Library, enable the Google Analytics Data API. If you are also connecting Google Ads and it isn’t enabled yet, enable the Google Ads API now too, so you don’t have to come back.
3. If you ticked Also apply this service account to GA4 while setting up Google Ads, you are done here: the GA4 card already holds the key (it shows Service account saved), and the key does not change when you enable an API. Skip to granting it access to the property.
4. Otherwise, in IAM & Admin → Service Accounts, reuse the reporting service account from Google Ads setup or create a new one.
5. Open it, then Keys → Add key → Create new key → JSON. The key file downloads; keep it on this machine.
6. If a dialog headed “Service account key creation is disabled” appears instead of a download, jump to the last section on this page. It is a one-time fix with its own short video; come back here once the key has downloaded.

Grant it access to the property

• This grant is the step people skip: a service account in the right Cloud project has no GA4 access until the property itself names it. Skipping it is the most common GA4 mistake, and it fails at Verify rather than silently later.

1. Back in GA4, go to Admin and open property access management.
2. Add the service account’s email (it ends .iam.gserviceaccount.com) with Viewer access.

Drop the key on the card and verify

• After import the file field reads Not set. That is expected: only the extracted email and key pair are stored, shown under Advanced.

1. In Abaxar, open Settings → Connectors and scroll to the GA4 card.
2. Enter the numeric property id, then drop or choose the downloaded JSON key file on the recommended field. Abaxar validates it locally and stores only the service-account email and private key, never the raw file.
3. If Google Ads shares this service account, tick Also apply this service account to Google Ads to configure both from the one file.
4. Click Save GA4 keys, then Verify. Verify mints a token and runs a tiny report against the property, so a missing Viewer grant shows up here.
5. Choose the backfill window and click Run backfill.
6. Delete the downloaded .json key file once the import is verified; Abaxar doesn’t need it again.

If something looks wrong

• Verify fails after a clean save: almost always the Viewer grant on the property is missing, or it was added on a different property than the id you entered.
• GA4 rejects the service-account email with "This email doesn’t match a Google Account": a known Google-side UI bug with newly created service accounts. Don’t start changing Cloud IAM; the account is valid. Abaxar’s bundled docs carry an Admin API fallback that adds the grant directly, and your AI assistant can run it with you.
• GA4 revenue won’t match your store’s revenue, and isn’t supposed to: it is what GA4 managed to attribute, after consent banners and ad blockers. Abaxar stores it under its own name and never adds it to commerce revenue.

If you see “Service account key creation is disabled”

The dialog has that title, a red banner reading “An organisation policy that blocks service accounts key creation has been enforced on your organisation”, and an Enforced organisation policy IDs line naming iam.disableServiceAccountKeyCreation. It is expected on any business-domain (Google Workspace) Google account: Google switches this policy on for every Cloud organisation created since May 2024, so it is a default, not a fault. A personal Gmail account never sees it.

The fix is a one-time override on your Abaxar project. It covers both Google Ads and GA4, and you can put enforcement back afterwards. The override needs a role your Google user doesn’t hold yet, even as the project owner and the only person on the account, so the steps grant that role first and then make the override. The dialog’s own “disable” link only opens Google’s documentation, so close it and follow the video or the steps below, then carry on with the setup where you left off.

Watch the walkthrough

1. Close the dialog. The role you need can only be granted on the organisation itself, and “No organisation” is not your organisation (it is a scope for projects outside any organisation, and IAM won’t open there). Click the project picker at the top of the console and, on the All tab, click the top row of the tree: your domain name with a building icon, not a project under it. The picker button now reads your domain name.
2. Open IAM & Admin → IAM. It reloads for the organisation, with your email already listed as Organisation Administrator and a Grant access button at the top. Click Grant access, add your own email address as the principal, paste the role name below into the role search, pick the exact match (not Organisation Administrator and not OrgPolicy Simulator Admin), and save.

   The console may spell it Organisation; either spelling finds it.

   Organization Policy Administrator

3. Switch the picker back to your Abaxar project. Open IAM & Admin → Organisation policies and paste the policy id below into the filter box.

   Filter by constraint name, ID or type.

   iam.disableServiceAccountKeyCreation

4. Two rows can appear with the same name. Open the one whose ID is exactly iam.disableServiceAccountKeyCreation, the ID the dialog named. Leave the iam.managed.disableServiceAccountKeyCreation row alone.
5. Click Manage policy (enabled now that you hold the role). Under Policy source choose Override parent’s policy, then click Add a rule, set Enforcement to Off, click Done, then Set policy. Back on the list, both rows now show an Enforcement state of Inactive.
6. Give it a minute, then go back to the service account’s Keys tab and create the JSON key again (Add key → Create new key → JSON). It downloads this time. Pick the setup up where you left off.
7. Optional, once the key is downloaded: put enforcement back with Manage policy → Inherit parent’s policy → Set policy. Existing keys keep working; only future key creation needs the override again.

Set up the next connector