IntegrationsGoogle Analytics

Google Analytics 4 Integration

Connect your Google Analytics 4 property to track website analytics, user behavior, and conversion metrics in Aim.

Overview

This integration allows you to:

  • Track website traffic and user behavior
  • Monitor conversion events and goals
  • Analyze user engagement metrics
  • Import custom dimensions and metrics
  • Sync data automatically on your chosen schedule
Setup time: 10-15 minutes

Intermediate

Prerequisites

Google Analytics 4 PropertyRequired

You need an active GA4 property with data flowing to it

Admin AccessRequired

You must have admin access to both GA4 and Google Cloud Console

Google Cloud ProjectRequired

A Google Cloud project (free to create if you don't have one)

Setup Overview

1
Create Service Account

Set up Google Cloud service account and credentials

5 min
2
Grant GA4 Access

Add service account to your GA4 property

2 min
3
Configure in Aim

Upload credentials and test connection

3 min
4
Select Metrics

Choose which metrics to track

2 min

Step 1: Create Service Account

1.1 Select or Create Google Cloud Project

First, you’ll need a Google Cloud project to house your service account.

Open Project Selector

Go to the Google Cloud Console Project Selector and choose an existing project or create a new one.

Create New Project (if needed)

If you don’t have a project, click Create Project and enter:

  • Project name: aim-analytics-integration (recommended)
  • Organization: Not required, can leave as “No organization”
  • Location: Doesn’t affect API access

Click Create and wait a few seconds for it to initialize.

1.2 Enable Google Analytics Data API

The Analytics Data API must be enabled for your project.

Visit API Library

Open the Analytics Data API page in Google Cloud Console.

Enable the API

Click the Enable button. This takes a few seconds.

Verify

You can verify it’s enabled by visiting the API Dashboard.

1.3 Create Service Account

Now create a service account that Aim will use to access your GA4 data.

Open Service Accounts

Navigate to IAM & Admin > Service Accounts.

Create Service Account

Click + Create Service Account at the top.

Fill in Details

  • Service account name: aim-analytics-connector (recommended)
  • Service account ID: Auto-generated (e.g., aim-analytics-connector)
  • Description: “Service account for Aim to access Google Analytics data”

Click Create and Continue.

Skip Role Assignment

You can skip the “Grant this service account access to project” step. Roles are not needed at the project level - we’ll grant access directly in GA4.

Click Continue, then Done.

1.4 Create and Download JSON Key

Find Your Service Account

In the service accounts list, click on the service account you just created.

Open Keys Tab

Click the Keys tab.

Add New Key

Click Add Key > Create new key > Select JSON format > Click Create.

The JSON key file will automatically download to your computer.

⚠️

Important: This JSON file contains credentials that allow access to your GA4 data.

  • Do NOT commit it to source control (Git, GitHub, etc.)
  • Store it securely (password manager or secrets manager)
  • Treat it like a password
  • Rotate keys periodically (every 90 days recommended)

Troubleshooting: Organization Policy Blocks Key Creation

🚫

If you see “Organization Policy blocks service account key creation”, your Google Cloud organization has security policies preventing key creation.

Why this happens: Many enterprises block service account key creation to enforce more secure authentication methods like Workload Identity Federation.

Solutions:

You cannot proceed without org admin help. Ask your Google Cloud organization administrator to:

  1. Grant you the Organization Policy Administrator role, OR
  2. Disable the “Block service account API key bindings” policy for your project, OR
  3. Create the service account key on your behalf and share it securely

For Admins - How to Allow Key Creation:

Go to Organization Policies (must be at org level, not project level).

Find the Policy

Look for “Block service account API key bindings” (ID: iam.managed.disableServiceAccountApiKeyCreation)

Edit Policy

Click the three-dot menu → Edit policy

  • Select Customize
  • Click Add a rule
  • Set Enforcement to Off
  • Under “Condition”, add: resource.matchProject("projects/PROJECT_ID")
  • Replace PROJECT_ID with your actual project ID
  • Click Save

Alternative: Disable Entirely (Less Secure)

  • Select Off under “Policy enforcement”
  • Click Save

⚠️ This allows key creation org-wide, which is less secure.

Option 2: Use Workload Identity Federation (Advanced)

For organizations that require keyless authentication, you can use Workload Identity Federation. This is more complex to set up but eliminates the need for service account keys.

Contact Aim support for help setting this up.


Step 2: Grant GA4 Access

Now that you have a service account, you need to grant it access to your Google Analytics 4 property.

2.1 Find Your Service Account Email

Open the JSON key file you downloaded. Look for the client_email field:

{
  "type": "service_account",
  "project_id": "your-project-id",
  "client_email": "aim-analytics-connector@your-project-id.iam.gserviceaccount.com",
  ...
}

Copy this email address - you’ll need it in the next step.

2.2 Add User to GA4 Property

Open Google Analytics

Go to Google Analytics and select your property.

Open Admin Settings

Click the Admin gear icon in the bottom left corner.

In the Property column (middle column), click Property Access Management.

Add New User

Click the + button in the top right → Add users.

Enter Service Account Email

Paste the service account email address from your JSON file.

Assign Viewer Role

  • Uncheck “Notify new users by email” (the service account can’t receive email)
  • Under “Roles and data restrictions”, select Viewer
  • Do NOT check “Direct role restrictions” unless you need to limit specific data access

Click Add

Click Add in the top right to save.

Why Viewer role? The Viewer role provides read-only access to all data in the property. This is sufficient for Aim to fetch metrics. For enhanced security, you can restrict access to specific data streams using “Direct role restrictions”, but most users should leave this unchecked.


Step 3: Configure in Aim

Now you’re ready to set up the connection in Aim.

3.1 Find Your GA4 Property ID

Open GA4 Admin

In Google Analytics, click Admin (gear icon).

Open Property Settings

In the Property column, click Property Settings.

Copy Property ID

You’ll see your Property ID at the top (looks like 123456789). Copy this number.

3.2 Create Connection in Aim

In Aim, go to Systems in the left sidebar.

Add Integration

Click + Add Integration → Select Google Analytics.

Enter Connection Name

Give your connection a descriptive name, like “Main Website GA4” or “Production Analytics”.

Enter Property ID

Paste the Property ID you copied from GA4.

Upload Service Account JSON

Either:

  • Click Upload JSON and select the key file, OR
  • Open the JSON file, copy its entire contents, and paste into the text area

Choose Refresh Cadence

Select how often Aim should sync data:

  • Hourly - For frequently updated dashboards
  • Daily (recommended) - For most use cases
  • Weekly - For high-level reporting

Test Connection

Click Test Connection. Aim will verify:

  • ✓ JSON credentials are valid
  • ✓ Service account has access to GA4
  • ✓ Property ID is correct
  • ✓ Analytics Data API is accessible

Save

If the test succeeds, click Save to create the connection.

🚫

If the connection test fails, check:

  • Invalid credentials: Make sure you pasted the entire JSON file contents
  • Permission denied: Verify the service account was added to GA4 with Viewer role
  • Invalid property ID: Double-check the Property ID from GA4 settings
  • API not enabled: Ensure Analytics Data API is enabled in Google Cloud Console
  • Service account email mismatch: Verify the email in the JSON matches what you added to GA4

Still stuck? Check the troubleshooting guide.


Step 4: Select Metrics

Choose which Google Analytics 4 metrics you want to track in Aim.

Available Metrics

User & Session Metrics

  • Active Users - Distinct users who visited your site
  • New Users - First-time visitors
  • Sessions - Number of sessions
  • Average Session Duration - Length of sessions
  • Sessions per User - Average sessions per user

Engagement Metrics

  • Engagement Rate - Percentage of engaged sessions
  • Bounce Rate - Percentage of non-engaged sessions
  • Average Engagement Time - Time users spent actively engaged
  • User Engagement - Engaged sessions per user
  • Events per Session - Average events per session

Content Metrics

  • Page Views - App screens or web pages viewed
  • Screens per Session - Average screens per session
  • Event Count - Total number of events

Conversion & Revenue Metrics

  • Conversions - Conversion events triggered
  • Total Revenue - Revenue from purchases and subscriptions
  • Session Conversion Rate - Percentage of sessions with conversions
  • Revenue per User - Average revenue per user
  • ARPPU - Average revenue per paying user

Custom Metrics & Dimensions

Aim also supports importing custom dimensions and metrics you’ve defined in GA4. These will appear in the metric selection list once the initial connection is established.

To add custom dimensions:

  1. Set them up in GA4 first
  2. Re-sync your Aim connection
  3. They’ll appear in the available metrics list

Metric Recommendations

For most websites, we recommend tracking these core metrics:

  • Active Users
  • Sessions
  • Engagement Rate
  • Bounce Rate
  • Conversions
  • Total Revenue (if applicable)
  • Page Views

You can always add more metrics later.


Data Sync & Refresh

Initial Sync

After completing setup, Aim will perform an initial data sync:

  • Historical data: Last 90 days (Pro/Enterprise plans) or 30 days (Free plan)
  • Sync time: 5-15 minutes depending on data volume
  • Status: Monitor progress in SystemsYour ConnectionSync History

Ongoing Syncs

Based on your chosen refresh cadence:

  • Hourly: Every hour at :05 past the hour
  • Daily: Every day at 12:00 AM UTC
  • Weekly: Every Monday at 12:00 AM UTC

Manual Refresh

You can trigger a manual refresh anytime:

  1. Go to SystemsYour Connection
  2. Click Sync Now
  3. Wait for sync to complete (usually 1-3 minutes)

Using GA4 Metrics in Aim

Creating Metrics

Once your integration is synced, you can create metrics from GA4 data:

  1. Go to MetricsCreate Metric
  2. Select your GA4 connection as the data source
  3. Choose the metric you want to track
  4. Add filters, segments, or date ranges as needed
  5. Click Create

Learn more about creating metrics →

Building Dashboards

Add GA4 metrics to dashboards:

  1. Go to Dashboard+ Add Widget
  2. Choose a widget type (Metric Card, Line Chart, etc.)
  3. Select your GA4 metric
  4. Customize visualization
  5. Click Add to Dashboard

Learn more about dashboards →

Setting Up OKRs

Use GA4 metrics as Key Results in OKRs:

  1. Go to OKRsCreate Objective
  2. Add a Key Result
  3. Link it to a GA4 metric
  4. Set target value and deadline
  5. Track progress automatically

Learn more about OKRs →


Best Practices

Security

  • Rotate keys regularly: Generate new service account keys every 90 days
  • Use separate service accounts: Don’t reuse service accounts across multiple tools
  • Minimum permissions: Only grant Viewer role unless you need editor access
  • Monitor access: Regularly review service accounts in GA4 Admin > Property Access Management
  • Store securely: Use a secrets manager (AWS Secrets Manager, Google Secret Manager, etc.)

Performance

  • Choose appropriate cadence: Most use cases work fine with daily syncs
  • Start with core metrics: Don’t import all metrics unless you need them
  • Use date ranges: Filter to relevant time periods to reduce data volume
  • Monitor quota: GA4 API has request limits; contact support if you hit them

Reliability

  • Set up alerts: Get notified if syncs fail
  • Check sync history: Regularly review SystemsConnectionSync History
  • Test after changes: If you modify GA4 setup, re-test the Aim connection
  • Keep credentials valid: Service account keys don’t expire, but org policies might change

Troubleshooting

Common Issues

”Permission denied” error

Cause: Service account doesn’t have access to GA4 property

Solution:

  1. Verify the service account email in your JSON file
  2. Check that this exact email was added to GA4 Property Access Management
  3. Confirm Viewer role was assigned
  4. Wait 5 minutes for permissions to propagate, then retry

”Invalid grant” or “Invalid credentials”

Cause: JSON key is malformed or incorrect

Solution:

  1. Ensure you copied the ENTIRE JSON file contents
  2. Check that the JSON is valid (use a JSON validator if unsure)
  3. Try re-downloading the key from Google Cloud Console
  4. Create a new key if the old one was deleted

No data appearing after sync

Cause: Property ID might be incorrect, or GA4 property has no data

Solution:

  1. Double-check the Property ID in GA4 Admin > Property Settings
  2. Verify your GA4 property has data (check in GA4 first)
  3. Check date ranges - Aim defaults to last 30 days
  4. Try a manual refresh in Aim

Sync fails with “Quota exceeded”

Cause: Too many API requests to GA4

Solution:

  1. Reduce number of metrics being synced
  2. Increase refresh cadence (daily instead of hourly)
  3. Contact Aim support to review your quota usage

Still Having Issues?


Next Steps

Consider connecting these complementary tools:

  • Amplitude - Product analytics for deeper user insights
  • Segment - Customer data platform to centralize events
  • BigQuery - Export GA4 data to your warehouse for custom analysis