QuickOn – Google OAuth Verification & Access Grant Flow

Описание: This video demonstrates how QuickOn, a client onboarding and access-management platform for marketing agencies, uses Google OAuth 2.0 to connect user accounts securely.

After signing in with Google, the client’s associated assets—Google Ads, Analytics (GA4), Tag Manager, Merchant Center, and Business Profile—are fetched automatically.
The client then selects which accounts to share with their agency. When they click Confirm, QuickOn uses the authorized scopes to send access invitations or create access bindings for the chosen accounts.

All actions are fully consent-based, token data is encrypted (AES-GCM), and users can revoke access anytime from their Google Account.

Scopes used:
Analytics (read/manage users), Tag Manager (read/edit/manage), Ads (adwords), Business Profile (business.manage), Merchant Center (content).

This verification video shows the end-to-end process required for Google OAuth scope approval for the QuickOn App.

Google Analytics (GA4) — used by createGaAccessBindingWithRetry (Analytics Admin)

…/auth/analytics.readonly
Needed to list accounts/properties so the client can choose which ones to share (read-only discovery).

…/auth/analytics.edit
Required to create access bindings for the selected properties (adds the agency user with Viewer/Admin).

…/auth/analytics.manage.users
Needed to add or update user access on the selected properties after client confirmation.

…/auth/analytics.manage.users.readonly
Used to check existing user permissions to avoid duplicate or conflicting invites.

Google Tag Manager — used by inviteTagManagerUser

…/auth/tagmanager.manage.accounts
Allows listing GTM accounts and sending user permissions on selected accounts.

…/auth/tagmanager.manage.users
Grants the agency user appropriate GTM permissions at account/container level.

…/auth/tagmanager.readonly
Lets QuickOn read accounts/containers for selection and status.

…/auth/tagmanager.edit.containers
Only when the client selects Manage; enables setting container-level permissions (e.g., publish/read).

Likely remove (not used by your code):
…/auth/tagmanager.delete.containers, …/auth/tagmanager.edit.containerversions.
If you don’t delete containers or edit versions, drop these to reduce review friction.

Google Ads — used by inviteGoogleAdsUser

…/auth/adwords
Required to send Google Ads invitations (READ_ONLY/ADMIN) to the agency for the client-selected customer IDs.

Business Profile — used by myBusiness.accounts.admins.create

…/auth/business.manage
Needed to add the agency email as Manager/Site Manager on the selected Business Profile account.

Merchant Center — used by createMerchantCenterUserWithRegistration

…/auth/content
Needed to add the agency user (READ/ADMIN) on selected Merchant Center accounts and handle developer registration when required.

Search Console (FYI)

…/auth/webmasters.readonly (optional for discovery)
Lets QuickOn list verified sites for selection.
Note: Sharing itself is manual in Search Console; your flow marks it as manual_required.