Answer
Google is the one platform where Brew's approval is done: the OAuth app for project squareup-492617 was verified on 21 October 2026 for exactly two sensitive scopes, Ads and Analytics read only, and the rule is that any new scope re-opens review, so none is added without a reason Param accepts.
Today
The project and the clients
| Fact | Value | Source |
|---|---|---|
| Project | squareup-492617, shared by Brew and the old SquareUp cockpit | memory brew-google-oauth-scopes |
| Brew's connect client | "SquareUp Ads API Ingestion", 223432117369-g6k9… | memory brew-google-oauth-scopes |
| Local MCP client | "Claude MCP" Desktop client 223432117369-ot3d…, behind ~/.config/google-mcp/adc.json, re-minted with Ads and Analytics only |
memory brew-google-oauth-scopes |
| Developer token | GOOGLE_ADS_DEVELOPER_TOKEN, tied to this one project; it reads real accounts already |
brew/connectors/google.js:17 brew/docs/connectors-approvals.md:22-24 |
| Ads API version | GOOGLE_ADS_API_VERSION, default v26; v21 was retired and answered 404 |
brew/connectors/google.js:14-16 |
| Callbacks | /auth/google/callback and /connect/<id>/callback on both sites |
brew/docs/production.md:119-121 |
Scopes
| Scope | Why | Source |
|---|---|---|
| openid, email, profile | Sign in | memory brew-google-oauth-scopes |
adwords |
Google Ads read through GAQL searchStream | brew/connectors/google.js:1-3, 18 |
analytics.readonly |
GA4 through the Data API runReport | brew/connectors/google.js:3, 18 |
The five old cockpit scopes, calendar, events, Meet, Drive and Gmail, are not Brew's and were removed from the consent screen memory brew-google-oauth-scopes.
Verification history
| Date | What happened | Source |
|---|---|---|
| 16 Oct | Verification and Ads Basic access submitted; GOOGLE_OAUTH=1 on, with the unverified warning and a 100 user cap |
memory brew-real-connectors brew/docs/connectors-approvals.md:19-23 |
| 19 Oct | Rejected: cloud-platform requested but not configured; cause was the local MCP client minted by gcloud auth application-default login; re-minted |
memory brew-google-oauth-scopes |
| 21 Oct | Rejected again: the consent screen showed a third line; cause was include_granted_scopes=true in google.js, removed in 1afb9ba |
memory brew-google-oauth-scopes |
| 21 Oct evening | Verified: branding and data access, adwords and analytics.readonly; the unverified warning is gone |
memory brew-google-oauth-scopes |
Ads Basic access was applied for on 16 Oct; no source records Google's answer memory brew-real-connectors.
How a brand connects
| Route | Review needed | Source |
|---|---|---|
One-click Google sign in for Ads and GA4, GOOGLE_OAUTH=1 on both sites |
Done, verified | brew/tools/prod-env.sh:9 brew/deploy.sh:41 |
GA4 by property ID, with brew-runtime@squareup-492617.iam.gserviceaccount.com added as Viewer |
None | brew/docs/connectors-approvals.md:10 brew/connectors/google.js:5-6 |
| A manager account: the ad accounts under it are listed and read through the manager | Done, same sign in | brew/connectors/google.js:104-108 |
A GA4 property used by another brand, or whose web stream is not the brand's site, is refused unless staff override handbook engineering/connectors. Google Ads is read every 6 hours, GA4 every 6 handbook engineering/connectors.
Tomorrow
| Item | Version | Tag |
|---|---|---|
adwords and analytics.readonly, read only |
v1 | Stays |
| Search Console read for the brand's own search terms | v2 | New, adds a scope and a review |
| Google Merchant Center read | v3 | New, adds a scope and a review |
| Ads changes such as pausing or budgets | v4 | Changes the use of adwords, needs a new justification and a person's yes per action |
The v2 to v4 rows are proposals for Param, not decisions.
How we do it
- Never re-run
gcloud auth application-default loginwith the Claude MCP client: it addscloud-platformand brings the discrepancy back memory brew-google-oauth-scopes. - Never add
include_granted_scopesback to google.js memory brew-google-oauth-scopes. - Before adding any scope, write the reason in this document's Open part and wait for Param's yes; then record a new demo video whose consent screen shows exactly the permission lines asked for memory brew-google-oauth-scopes.
- When Google sends an Ads API sunset email, bump the version and redeploy:
GOOGLE_ADS_API_VERSION=v27 ./deploy.sh # the number from Google's email
brew/connectors/google.js:14-16
- To re-record a consent video, first remove SquareUp at myaccount.google.com/connections for the recording account memory brew-google-oauth-scopes.
Numbers
| Metric | Definition | Where measured |
|---|---|---|
| Scopes on the consent screen | Count of scopes in Data Access, target 5 | Google Auth Platform, Proposed |
| Live Google connections | Google Ads and GA4 connections in state live | connections on production, Proposed |
| Ads reads failing | Google Ads reads that fail in a day | Server log [google], Proposed |
Open
- Did Ads Basic access come through? No source after 16 Oct. Proposal: Param checks the API Center today; until then the developer token keeps reading as it does.
- Search Console as a connector. Treg's catalog lists it as connected and free, but no Brew connector reads it memory treg-catalog-for-brew. Proposal: add it in v2 together with any other new scope, in one review.
- One project for Brew and the old cockpit. Proposal: keep sharing it, because the developer token is tied to this project, and retire the cockpit's Google connect instead.