Connect Google Search Console for a domain

Each domain in your workspace connects to its own Google Search Console property with a credential that you own. A connection is read-only. It proves to Noxtica that you control the hostname, so SEO checks and crawls can run, and it feeds a search position trend.

A workspace administrator does this in Backoffice and in the Google Cloud and Search Console consoles.

What it is

Availability depends on your plan, role and the modules enabled for your organisation.

Noxtica reads Search Console data with the read-only Google scope https://www.googleapis.com/auth/webmasters.readonly. It cannot change a property, a sitemap or a user list.

One connection per domain

• Every domain row of your workspace has its own connection. Different domains can use different service accounts, OAuth clients or Google accounts.
• Saving a new connection for a domain that already has one replaces it. The old row is kept in a history list (Replaced by a newer credential, Removed, Rejected by Google).
• Backoffice never shows a key or secret again after you save it.

Credential types

Property types

The property must belong to the domain you connect. A property for another domain is refused with “The property does not match this domain”.

What appears in Backoffice

• The Domains table on Backoffice → SEO & Marketing → Search Console: status (Active, Needs attention or Not connected), credential type, Google account or service account, property, permission level, and Last sync (the time of the last successful Search Analytics fetch).
• The ownership proof for SEO Check and Site Crawls. See SEO tools: page checks, site crawls and search score.
• A Search position trend panel under the SEO Check page. It shows the daily average position from your connected properties and says “No search position data yet” until a connected property has reported search results. Noxtica uses Search Console data only and never scrapes search results.

The Search Console page does not include a Search Analytics explorer or a URL-inspection tool.

Prerequisites

• Administrator role with a fresh step-up MFA confirmation. Adding, rotating, editing and removing a connection each ask for it. The Test action needs the administrator role and no step-up. Platform administrators can view status but cannot change connections.
• The domain exists in your workspace (Backoffice → Domains).
• A Search Console property for the domain that is verified in Google Search Console, on which you or the Google account you use has owner or full access.
• A Google Cloud project you control. Noxtica does not need access to it; it only hosts the service account or the OAuth client.
• Search Console connections enabled for your organisation. If not, Backoffice shows “Search Console features are not available yet” or “Search Console is not set up yet”.

Steps

Open Backoffice → SEO & Marketing → Search Console. The page has two tabs: Domains and Setup guide. The Setup guide repeats the Google-side steps below.

A. Service account (recommended)

1. In the Google Cloud Console, choose or create a project. Any project you control works.
2. APIs & Services → Library: search for Google Search Console API and press Enable. Without it Noxtica reports that the API is not enabled and names the project.
3. IAM & Admin → Service Accounts → Create service account. Name it, for example, noxtica-search-console. It needs no Google Cloud role.
4. Open the service account → Keys → Add key → Create new key → JSON → Create. Google downloads the key once.
5. In Google Search Console, choose the property → Settings → Users and permissions → Add user. Paste the service-account e-mail (it ends in .iam.gserviceaccount.com) and give it Restricted or Full permission.
6. In Backoffice, on the Domains tab press Add on the domain’s row. Keep Service account JSON key (recommended) selected, enter the Search Console property, upload the key file (or paste its contents) and press Save and test. Confirm step-up MFA.

Noxtica checks the key, the property and the permission before it stores anything. The check lists the properties the account can see, requires yours to be among them and verified, and runs one small Search Analytics query. If any step fails, nothing is stored and the message names the cause.

7. When the row shows Active, delete the key file from your machine.

If key creation is disabled in Google Cloud, your organisation enforces a policy against service-account keys. Use the own OAuth client route instead.

B. Your own OAuth client

1. In your Google Cloud project, enable the Google Search Console API as above.

2. Open APIs & Services → OAuth consent screen (Google Auth Platform in newer consoles). Choose Internal if your Google Workspace organisation owns the project, otherwise External, and fill in the app name and a support e-mail.

3. Add these scopes: https://www.googleapis.com/auth/webmasters.readonly, openid and email.

4. Publish the app (publishing status In production). While an External app is in Testing status, Google expires its access after 7 days and the connection stops working.

5. APIs & Services → Credentials → Create credentials → OAuth client ID → Application type Web application.

6. Under Authorised redirect URIs add the exact address shown in the Backoffice dialog (Authorised redirect URI, with a Copy redirect URI button). It has the form:

   https://<your backoffice host>/api/seo/gsc/callback

   Google compares it character for character.

7. Copy the client ID and the client secret.

8. In Backoffice press Add on the domain’s row, choose My own OAuth client, enter the property, the client ID and the client secret, and press Continue to Google. Confirm step-up MFA.

9. Sign in with the Google account that has access to the property and allow read-only access. You return to the Search Console page, which shows the result.

Test a connection

Press Test on a row. Noxtica runs the same check as when you saved. The result shows the property, the permission level and the number of sample rows. A failed test marks the row Needs attention.

Change the property, rotate the credential or remove it

• Edit changes only the property. Noxtica checks the new property with the credential already stored.
• Rotate replaces the credential. The property stays the same; use Edit to change it.
• Remove stops Noxtica from using the connection. For an OAuth connection, Noxtica revokes its access at Google, then deletes the stored client secret and tokens. For a service account, Noxtica deletes the stored key; the service account stays a user on your property, and the key stays valid in Google Cloud until you delete them there.
• Show history lists replaced and removed credentials.

Verify it works

• The row for the domain shows Active, the credential type, the service-account e-mail or Google account, the property and the permission level (Owner, Full user or Restricted user).
• After you press Test, a “Test passed” message appears.
• SEO Check and Site Crawls accept the domain’s hostname. A Domain property covers subdomains; a URL-prefix property covers its exact host only.
• On an OAuth connection the URL briefly carries the result of the Google sign-in, then Backoffice removes it.

Troubleshooting

Related

• SEO tools: page checks, site crawls and search score for what the proof unlocks.
• Content Security Policy, hosts and first-party relay for relay hostnames, the other ownership proof.
• Domains, site keys and the install card for adding a domain.
• Sign-in, SSO, SCIM, MFA and IP allowlist for step-up MFA.
• Privacy and Security for data handling.