Help & setup

YAAPI Agent calls Google APIs on your behalf. Pick a mode below, follow the steps, then go to Settings to finish.

Which mode should I pick?

SituationRecommended mode
I want to test on my own GA4/GTM accountsUser OAuth
I run the agent 24/7 for several clientsService account
I deploy on Cloud Run / GKE (prod)Workload Identity Federation
Best for dev or single-user usage. You log in with your own Google account and the agent inherits your GA4/GTM/BigQuery permissions.
1Create or pick a GCP project

Go to console.cloud.google.com/projectcreate and create a project (e.g. yaapi-agent).

2Enable the required Google APIs

In APIs & Services → Enabled APIs, enable:

  • Google Analytics Admin API
  • Google Analytics Data API
  • Tag Manager API
  • BigQuery API
  • Google Sheets API
  • Google Drive API
Open the API library
3Configure the OAuth consent screen

APIs & Services → OAuth consent screen. Set the app name and your email, then add yourself as a Test user.

Add the following scopes:

  • openid
  • email
  • profile
  • auth/analytics.edit
  • auth/analytics.readonly
  • auth/analytics.manage.users
  • auth/tagmanager.edit.containers
  • auth/tagmanager.edit.containerversions
  • auth/tagmanager.publish
  • auth/tagmanager.manage.accounts
  • auth/tagmanager.manage.users
  • auth/bigquery
  • auth/spreadsheets.readonly
  • auth/drive.readonly
4Create an OAuth Client ID

APIs & Services → Credentials → + Create Credentials → OAuth client ID

  • Type: Web application
  • Authorized JavaScript origins:
  • Authorized redirect URIs:

Grab the Client ID and Client Secret.

5Configure .env.local

At the project root, in .env.local:

GOOGLE_OAUTH_CLIENT_ID=xxxx.apps.googleusercontent.com
GOOGLE_OAUTH_CLIENT_SECRET=GOCSPX-xxxx
REDIRECT_URI=http://localhost:3000/api/auth/google/callback
SESSION_PASSWORD=<32+ random characters>
ANTHROPIC_API_KEY=sk-ant-...

Generate a session password with: openssl rand -base64 48

6Restart and sign in

npm run dev → open Settings → click Sign in with Google → approve the scopes.

Security best practices

  • Never commit .env.local or SA keys — .gitignore + gitleaks pre-commit hook.
  • SESSION_PASSWORD ≥ 32 random characters (openssl rand -base64 48).
  • GCP roles: least privilege. Never roles/owner or roles/editor at project level.
  • One service account per use case (analytics, ci-deploy…), not a generic SA.
  • Rotate SA keys ≤ 90 days. Ideal: switch to Workload Identity and delete every key.
  • Enable Cloud Audit Logs → Data Access to trace access.
  • In prod: HTTPS mandatory, ratelimit on /api/chat and /api/uploads, Cloud Armor in front.
  • Uploads capped at 25 MB/file, 6h TTL; export files expire after 1 h.
  • SSRF already blocked for the http_request tool (private IPs and GCP metadata forbidden).
  • If a secret leaks (chat, screenshot, log): revoke it immediately in GCP / Anthropic.

After setup

  1. Go to Settings and click « Sign in with Google » (OAuth) or paste your JSON key (Service account).
  2. Come back to the home page — the agent is ready.
  3. Try « list my GA4 properties » or « audit my GTM container ».