Google data access
Why Webshop Vitals asks for Google permissions
The website audit works without Google. Connecting Google is optional and adds private diagnostics that only the merchant can authorize. This page identifies every requested permission, the feature it enables, and the limits we enforce.
Merchant Center
One Google scope, used only for reads
Google’s Merchant API requires the same content scope for its read and write methods. Google does not offer a narrower Merchant Center read-only OAuth scope, so we limit access in our own implementation.
Requested scope
https://www.googleapis.com/auth/contentThis permission enables the Merchant Center feature only. Basic account creation usesopenid, email, andprofile instead and never asks for catalogue access.
What the audit reads
- The Merchant Center accounts your Google account can access, so you can select the correct store account
- Processed product attributes and eligibility status, so we can compare Google’s copy with your live storefront
- Product-level and account-level issues, so the audit can show disapprovals, warnings, affected products, and fixes
- Product impressions, clicks, and conversion summaries, so monitoring can prioritize problems by observed impact
Least privilege
Permission at Google, read-only behavior in Webshop Vitals
The scope technically permits writes, but the Webshop Vitals Merchant client implements no product, feed, data-source, or account mutation methods.
- The connection is optional and starts only when you choose Connect Merchant Center.
- Webshop Vitals calls list, get, and report-search operations only. It does not call create, update, or delete operations.
- Refresh tokens are encrypted at rest with AES-256-GCM and are never displayed or logged.
- Disconnecting deletes the stored credential and attempts to revoke access with Google.
Search Console is separate
If you choose the optional Search Console integration, Webshop Vitals requestshttps://www.googleapis.com/auth/webmasters.readonlyin a separate authorization step. It reads only properties, search analytics, sitemaps, and URL inspection results. You are never asked for Search Console access merely because you connected Merchant Center.
Control stays with you
You choose whether to connect, which Merchant Center account belongs to the store, and when to disconnect. Existing audit history remains available after disconnect, but Webshop Vitals can no longer refresh it from Google.