Google Analytics 4 Integration
Connect your Google Analytics 4 property to track website analytics, user behavior, and conversion metrics in Aim.
Overview
This integration allows you to:
- Track website traffic and user behavior
- Monitor conversion events and goals
- Analyze user engagement metrics
- Import custom dimensions and metrics
- Sync data automatically on your chosen schedule
Intermediate
Prerequisites
You need an active GA4 property with data flowing to it
You must have admin access to both GA4 and Google Cloud Console
A Google Cloud project (free to create if you don't have one)
Setup Overview
Set up Google Cloud service account and credentials
Add service account to your GA4 property
Upload credentials and test connection
Choose which metrics to track
Step 1: Create Service Account
1.1 Select or Create Google Cloud Project
First, you’ll need a Google Cloud project to house your service account.
Open Project Selector
Go to the Google Cloud Console Project Selector and choose an existing project or create a new one.
Create New Project (if needed)
If you don’t have a project, click Create Project and enter:
- Project name:
aim-analytics-integration(recommended) - Organization: Not required, can leave as “No organization”
- Location: Doesn’t affect API access
Click Create and wait a few seconds for it to initialize.
1.2 Enable Google Analytics Data API
The Analytics Data API must be enabled for your project.
Visit API Library
Open the Analytics Data API page in Google Cloud Console.
Enable the API
Click the Enable button. This takes a few seconds.
Verify
You can verify it’s enabled by visiting the API Dashboard.
1.3 Create Service Account
Now create a service account that Aim will use to access your GA4 data.
Open Service Accounts
Navigate to IAM & Admin > Service Accounts.
Create Service Account
Click + Create Service Account at the top.
Fill in Details
- Service account name:
aim-analytics-connector(recommended) - Service account ID: Auto-generated (e.g.,
aim-analytics-connector) - Description: “Service account for Aim to access Google Analytics data”
Click Create and Continue.
Skip Role Assignment
You can skip the “Grant this service account access to project” step. Roles are not needed at the project level - we’ll grant access directly in GA4.
Click Continue, then Done.
1.4 Create and Download JSON Key
Find Your Service Account
In the service accounts list, click on the service account you just created.
Open Keys Tab
Click the Keys tab.
Add New Key
Click Add Key > Create new key > Select JSON format > Click Create.
The JSON key file will automatically download to your computer.
Important: This JSON file contains credentials that allow access to your GA4 data.
- Do NOT commit it to source control (Git, GitHub, etc.)
- Store it securely (password manager or secrets manager)
- Treat it like a password
- Rotate keys periodically (every 90 days recommended)
Troubleshooting: Organization Policy Blocks Key Creation
If you see “Organization Policy blocks service account key creation”, your Google Cloud organization has security policies preventing key creation.
Why this happens: Many enterprises block service account key creation to enforce more secure authentication methods like Workload Identity Federation.
Solutions:
Option 1: Contact Your Organization Administrator (Recommended)
You cannot proceed without org admin help. Ask your Google Cloud organization administrator to:
- Grant you the
Organization Policy Administratorrole, OR - Disable the “Block service account API key bindings” policy for your project, OR
- Create the service account key on your behalf and share it securely
For Admins - How to Allow Key Creation:
Navigate to Organization Policies
Go to Organization Policies (must be at org level, not project level).
Find the Policy
Look for “Block service account API key bindings” (ID: iam.managed.disableServiceAccountApiKeyCreation)
Edit Policy
Click the three-dot menu → Edit policy
Add Exception for Project (Recommended)
- Select Customize
- Click Add a rule
- Set Enforcement to Off
- Under “Condition”, add:
resource.matchProject("projects/PROJECT_ID") - Replace
PROJECT_IDwith your actual project ID - Click Save
Alternative: Disable Entirely (Less Secure)
- Select Off under “Policy enforcement”
- Click Save
⚠️ This allows key creation org-wide, which is less secure.
Option 2: Use Workload Identity Federation (Advanced)
For organizations that require keyless authentication, you can use Workload Identity Federation. This is more complex to set up but eliminates the need for service account keys.
Contact Aim support for help setting this up.
Step 2: Grant GA4 Access
Now that you have a service account, you need to grant it access to your Google Analytics 4 property.
2.1 Find Your Service Account Email
Open the JSON key file you downloaded. Look for the client_email field:
{
"type": "service_account",
"project_id": "your-project-id",
"client_email": "aim-analytics-connector@your-project-id.iam.gserviceaccount.com",
...
}Copy this email address - you’ll need it in the next step.
2.2 Add User to GA4 Property
Open Google Analytics
Go to Google Analytics and select your property.
Open Admin Settings
Click the Admin gear icon in the bottom left corner.
Navigate to Property Access Management
In the Property column (middle column), click Property Access Management.
Add New User
Click the + button in the top right → Add users.
Enter Service Account Email
Paste the service account email address from your JSON file.
Assign Viewer Role
- Uncheck “Notify new users by email” (the service account can’t receive email)
- Under “Roles and data restrictions”, select Viewer
- Do NOT check “Direct role restrictions” unless you need to limit specific data access
Click Add
Click Add in the top right to save.
Why Viewer role? The Viewer role provides read-only access to all data in the property. This is sufficient for Aim to fetch metrics. For enhanced security, you can restrict access to specific data streams using “Direct role restrictions”, but most users should leave this unchecked.
Step 3: Configure in Aim
Now you’re ready to set up the connection in Aim.
3.1 Find Your GA4 Property ID
Open GA4 Admin
In Google Analytics, click Admin (gear icon).
Open Property Settings
In the Property column, click Property Settings.
Copy Property ID
You’ll see your Property ID at the top (looks like 123456789). Copy this number.
3.2 Create Connection in Aim
Navigate to Systems
In Aim, go to Systems in the left sidebar.
Add Integration
Click + Add Integration → Select Google Analytics.
Enter Connection Name
Give your connection a descriptive name, like “Main Website GA4” or “Production Analytics”.
Enter Property ID
Paste the Property ID you copied from GA4.
Upload Service Account JSON
Either:
- Click Upload JSON and select the key file, OR
- Open the JSON file, copy its entire contents, and paste into the text area
Choose Refresh Cadence
Select how often Aim should sync data:
- Hourly - For frequently updated dashboards
- Daily (recommended) - For most use cases
- Weekly - For high-level reporting
Test Connection
Click Test Connection. Aim will verify:
- ✓ JSON credentials are valid
- ✓ Service account has access to GA4
- ✓ Property ID is correct
- ✓ Analytics Data API is accessible
Save
If the test succeeds, click Save to create the connection.
If the connection test fails, check:
- Invalid credentials: Make sure you pasted the entire JSON file contents
- Permission denied: Verify the service account was added to GA4 with Viewer role
- Invalid property ID: Double-check the Property ID from GA4 settings
- API not enabled: Ensure Analytics Data API is enabled in Google Cloud Console
- Service account email mismatch: Verify the email in the JSON matches what you added to GA4
Still stuck? Check the troubleshooting guide.
Step 4: Select Metrics
Choose which Google Analytics 4 metrics you want to track in Aim.
Available Metrics
User & Session Metrics
- Active Users - Distinct users who visited your site
- New Users - First-time visitors
- Sessions - Number of sessions
- Average Session Duration - Length of sessions
- Sessions per User - Average sessions per user
Engagement Metrics
- Engagement Rate - Percentage of engaged sessions
- Bounce Rate - Percentage of non-engaged sessions
- Average Engagement Time - Time users spent actively engaged
- User Engagement - Engaged sessions per user
- Events per Session - Average events per session
Content Metrics
- Page Views - App screens or web pages viewed
- Screens per Session - Average screens per session
- Event Count - Total number of events
Conversion & Revenue Metrics
- Conversions - Conversion events triggered
- Total Revenue - Revenue from purchases and subscriptions
- Session Conversion Rate - Percentage of sessions with conversions
- Revenue per User - Average revenue per user
- ARPPU - Average revenue per paying user
Custom Metrics & Dimensions
Aim also supports importing custom dimensions and metrics you’ve defined in GA4. These will appear in the metric selection list once the initial connection is established.
To add custom dimensions:
- Set them up in GA4 first
- Re-sync your Aim connection
- They’ll appear in the available metrics list
Metric Recommendations
For most websites, we recommend tracking these core metrics:
- Active Users
- Sessions
- Engagement Rate
- Bounce Rate
- Conversions
- Total Revenue (if applicable)
- Page Views
You can always add more metrics later.
Data Sync & Refresh
Initial Sync
After completing setup, Aim will perform an initial data sync:
- Historical data: Last 90 days (Pro/Enterprise plans) or 30 days (Free plan)
- Sync time: 5-15 minutes depending on data volume
- Status: Monitor progress in Systems → Your Connection → Sync History
Ongoing Syncs
Based on your chosen refresh cadence:
- Hourly: Every hour at :05 past the hour
- Daily: Every day at 12:00 AM UTC
- Weekly: Every Monday at 12:00 AM UTC
Manual Refresh
You can trigger a manual refresh anytime:
- Go to Systems → Your Connection
- Click Sync Now
- Wait for sync to complete (usually 1-3 minutes)
Using GA4 Metrics in Aim
Creating Metrics
Once your integration is synced, you can create metrics from GA4 data:
- Go to Metrics → Create Metric
- Select your GA4 connection as the data source
- Choose the metric you want to track
- Add filters, segments, or date ranges as needed
- Click Create
Learn more about creating metrics →
Building Dashboards
Add GA4 metrics to dashboards:
- Go to Dashboard → + Add Widget
- Choose a widget type (Metric Card, Line Chart, etc.)
- Select your GA4 metric
- Customize visualization
- Click Add to Dashboard
Setting Up OKRs
Use GA4 metrics as Key Results in OKRs:
- Go to OKRs → Create Objective
- Add a Key Result
- Link it to a GA4 metric
- Set target value and deadline
- Track progress automatically
Best Practices
Security
- Rotate keys regularly: Generate new service account keys every 90 days
- Use separate service accounts: Don’t reuse service accounts across multiple tools
- Minimum permissions: Only grant Viewer role unless you need editor access
- Monitor access: Regularly review service accounts in GA4 Admin > Property Access Management
- Store securely: Use a secrets manager (AWS Secrets Manager, Google Secret Manager, etc.)
Performance
- Choose appropriate cadence: Most use cases work fine with daily syncs
- Start with core metrics: Don’t import all metrics unless you need them
- Use date ranges: Filter to relevant time periods to reduce data volume
- Monitor quota: GA4 API has request limits; contact support if you hit them
Reliability
- Set up alerts: Get notified if syncs fail
- Check sync history: Regularly review Systems → Connection → Sync History
- Test after changes: If you modify GA4 setup, re-test the Aim connection
- Keep credentials valid: Service account keys don’t expire, but org policies might change
Troubleshooting
Common Issues
”Permission denied” error
Cause: Service account doesn’t have access to GA4 property
Solution:
- Verify the service account email in your JSON file
- Check that this exact email was added to GA4 Property Access Management
- Confirm Viewer role was assigned
- Wait 5 minutes for permissions to propagate, then retry
”Invalid grant” or “Invalid credentials”
Cause: JSON key is malformed or incorrect
Solution:
- Ensure you copied the ENTIRE JSON file contents
- Check that the JSON is valid (use a JSON validator if unsure)
- Try re-downloading the key from Google Cloud Console
- Create a new key if the old one was deleted
No data appearing after sync
Cause: Property ID might be incorrect, or GA4 property has no data
Solution:
- Double-check the Property ID in GA4 Admin > Property Settings
- Verify your GA4 property has data (check in GA4 first)
- Check date ranges - Aim defaults to last 30 days
- Try a manual refresh in Aim
Sync fails with “Quota exceeded”
Cause: Too many API requests to GA4
Solution:
- Reduce number of metrics being synced
- Increase refresh cadence (daily instead of hourly)
- Contact Aim support to review your quota usage
Still Having Issues?
- Check the general integration troubleshooting guide
- Review GA4 API documentation
- Contact Aim support with:
- Connection name in Aim
- Error messages from sync logs
- Steps you’ve already tried
Next Steps
Related Integrations
Consider connecting these complementary tools: