Guide
What connecting a GA4 property actually involves
Connecting GA4 to a third-party tool sounds like it should involve a tracking snippet or a property ID. It does not. GA4 exposes two APIs — the Admin API for configuration and the Data API for reporting figures — and access to both is granted through Google OAuth against your own Google account.
That has a useful property: a tool can never see more than you can. If you have Viewer on nine properties and no access to a tenth, the tool sees nine. Permissions are enforced by Google on every request, not by the tool being well behaved.
What Tagfire asks for, and why
- Analytics read access
- Reads property configuration through the Admin API and behavioural figures through the Data API. This is what powers audits, the dimension checker, anomaly detectors, and the AI chats.
- Tag Manager access
- Only if you use the GTM tools. Read is enough for auditing, scanning, and tracing dependencies; write is needed only when you clone resources into a destination container, which you initiate explicitly.
- Refresh tokens
- Scheduled work — anomaly detectors and monitor runs — happens when you are not logged in. Tagfire stores a refresh token so those runs can mint short-lived access tokens independently of your browser session.
Everything in the GA4 audit path is read-only. The one place Tagfire writes to Google is when you deliberately edit a writable setting in the property manager or clone GTM resources — both explicit actions, never a side effect of a scan.
Why pinning matters if you manage many properties
A freelancer with three clients does not need this. An agency analyst whose Google account can see 200 properties absolutely does, and this is the case the feature exists for.
- Every property picker becomes a short list instead of a 200-row scroll
- Dashboard briefings summarise the properties you care about rather than everything
- The AI assistant knows which properties are in scope — it deliberately has no "list everything in Google" capability, so pinned properties are its entry point
- Workspace connections let a team share one agreed set of properties instead of each member curating their own
Pinning is not a permission boundary — it is a working set. Unpinning a property does not revoke anything, and you can pin it again whenever you need it.
What connecting unlocks
This step is a prerequisite rather than a destination. Once a property is connected you can:
- Run the GA4 audit — 18+ automated checks with a scored report
- Set up anomaly detectors that email you when metrics move past your thresholds
- Diff parameters against dimensions with the custom dimension checker
- Inspect and edit configuration in the property manager
- Review who has access with the access audit
- Ask questions about live data in the AI chats, with charts rendered from the answers
Revoking access
Access is revoked from your Google account security settings, not from Tagfire — which is the correct arrangement, because it means the decision cannot be blocked or delayed by the application holding the token. Revoke there and every stored token stops working immediately, including for scheduled runs.