Set up Google Search Console

Connect a CrawlKit site to Google Search Console with a tenant-scoped OAuth web client, an expiring one-time state, and a browser-compatible callback.

Authorized redirect URI:
https://api.crawlkit.app/api/v1/gsc/auth/callback
Register this exact value in Google Cloud. Do not add a trailing slash or substitute the apex or docs domain.

1. Configure Google Cloud

  1. Create or select a Google Cloud project.
  2. Enable the Google Search Console API.
  3. Configure the OAuth consent screen.
  4. Create an OAuth Web application client.
  5. Add https://api.crawlkit.app/api/v1/gsc/auth/callback under Authorized redirect URIs.
  6. If the consent app is in testing, add the Google account with GSC access as a test user.

CrawlKit requests webmasters.readonly, webmasters, and indexing. Enable the Web Search Indexing API only if you use the indexing endpoints, and follow Google's eligibility restrictions.

2. Store the tenant OAuth client

Use an owner/admin credential with settings.manage. CrawlKit encrypts the client secret with AES-256-GCM and never returns it.

curl -X PUT https://api.crawlkit.app/api/v1/gsc/auth/client \
  -H "Authorization: Bearer $CRAWLKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "YOUR_CLIENT_ID.apps.googleusercontent.com",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

Verify the redacted status:

curl https://api.crawlkit.app/api/v1/gsc/auth/client \
  -H "Authorization: Bearer $CRAWLKIT_API_KEY"

3. Start authorization

The caller needs gsc.connect. site_id binds the browser hand-off to the authenticated tenant and target site. Omit redirect_uri to use the production callback.

curl -X POST https://api.crawlkit.app/api/v1/gsc/auth/url \
  -H "Authorization: Bearer $CRAWLKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"site_id":"YOUR_SITE_UUID"}'

Open the returned URL, choose the Google account with GSC access, and approve. Google redirects to the public GET callback. No bearer header is required there: the callback accepts only a provider-bound state created by an authenticated request, valid for 10 minutes and one use.

4. Verify the connection

curl "https://api.crawlkit.app/api/v1/gsc/properties?site_id=YOUR_SITE_UUID" \
  -H "Authorization: Bearer $CRAWLKIT_API_KEY"

curl "https://api.crawlkit.app/api/v1/gsc/property?site_id=YOUR_SITE_UUID" \
  -H "Authorization: Bearer $CRAWLKIT_API_KEY"

Pi tool

crawlkit_gsc_authorize(
  site_id="YOUR_SITE_UUID"
)

site_url may be used when the tool can resolve it to a configured CrawlKit site. The production callback is the default.

Troubleshooting

redirect_uri_mismatch

Register the exact production callback in the same Google OAuth client stored for the tenant, wait briefly for propagation, and start a new authorization.

Invalid, expired, denied, or already-used state

Request a new authorization URL. Never replay a callback copied from browser history.

Connected but no property match

Grant the Google account access to the matching domain or URL-prefix property, then query the property endpoints again.

PreviousIntegrations NextUse GSC