Learn · Setup guides

Connect Google Merchant Center to Outloop

Last updated: August 28, 2026

What this setup gives you

One agency Google identity across many client Merchant accounts, with the account boundary decided by configuration rather than by whatever the prompt happens to say.

• ✓Each client workspace is pinned to its own Merchant account ID.
• ✓A request naming a different Merchant account is refused before any call reaches Google.
• ✓Account-administration calls are blocked outright, not left to the agent's judgement.
• ✓The refresh token is minted host-side and never appears on your clipboard or in a prompt.

What you need before starting

• ✓Access to a Google Cloud project with the OAuth consent screen configured.
• ✓A Client ID and Client Secret for your first Google connector. After that, Outloop reuses the saved Google OAuth app and never asks for the secret again.
• ✓The Google account with access to the client's Merchant Center — you will sign in as it in your browser.
• ✓The Merchant account ID this workspace should be allowed to use.
• ✓Outloop installed and activated, with a workspace selected.

Which Google account connects what

1. Enable the Merchant API

In Google Cloud Console, open APIs & Services → Library, search Merchant API, and click Enable. Outloop calls it at merchantapi.googleapis.com.

2. Create the OAuth client (once, for all Google connectors)

In Google Auth Platform → Clients, create a Web application OAuth client and copy the Client ID and Client Secret. Under Authorized redirect URIs add Outloop's local callback — without it the browser connect below fails with redirect_uri_mismatch:

http://127.0.0.1:44317/oauth2/callback

The full one-time Google Cloud walkthrough — project, APIs, the whole scope set in one paste, and the publishing-status step that stops a working connection expiring after about a week — is in Set up one reusable Google Cloud OAuth app. If you already have a saved Google OAuth app, there is nothing to create here. The scopes this connector requests are:

https://www.googleapis.com/auth/content
openid
email

The openid and email scopes are how Outloop verifies which Google account you actually connected. That identity check is Google OIDC and involves no Drive scope.

Shared agency app or workspace-dedicated?

3. Add Merchant Center in Outloop

In Outloop, open API Keys & Access → Add an API key and choose Google Merchant Center. The panel opens on Connect in your browser, with the Cloud Console detail in the collapsed Setup details — Google Cloud OAuth client, scopes and caveats and Before you connect disclosures. Check the Google OAuth app dropdown — a saved profile supplies the app with no Client Secret to re-enter.

4. Connect the account in your browser

Click Connect Google Merchant Center in your browser. Google's own sign-in opens, you sign in as the account with Merchant Center access, and you approve the consent screen there. Outloop mints and stores the refresh token host-side.

5. Confirm the account and capabilities

Outloop shows Connected as the Google account you just used — check it before an agent touches live product data. Under Agents will be able to (change any time in the Access profile), practical capabilities are pre-checked and destructive ones are prefixed ⚠ and left unchecked. Then click Confirm — this is the approved account.

6. Save the Access Profile and map the Merchant account

This is the step that separates clients. Enter the Merchant account ID this workspace is allowed to use:

workspace_001
→ allowed merchant_id: <MERCHANT_ID>

A request naming a different Merchant account is denied before the credential is read. That is what makes one agency Google identity safe to use across a roster of client Merchant accounts.

7. Run the first proof

Ask the agent for a safe read of the approved account:

{
  "tenant": "<WORKSPACE_ID>",
  "service": "google_merchant_center",
  "verb": "api_bridge.request",
  "method": "GET",
  "path": "/accounts/v1/accounts/<MERCHANT_ID>"
}

Success criteria:

decision: allow
HTTP 200
the account returned is this workspace's approved Merchant account
secret_exposed: false
audit entry exists

What stays blocked

• →A different Merchant account — refused before the credential is read; no Google call is made.
• →Account administration — blocked by runtime policy with ACCOUNT_ADMIN_BLOCKED. This is a hard block, not a capability you can enable from the agent side.

Changing the account or the credential later

Verified vs not claimed yet

"Verified" here means a real proof passed through Outloop in a workspace — it is never a product-level claim about the connector.

• Verified A read-only proof through Outloop against a live Merchant account: decision: allow, HTTP 200, secret_exposed: false.
• Supported, not verified yet Write operations — feed and product changes. Supported by the API and permitted through bridge policy when authorized, but not runtime-verified. Only a read proof was run, deliberately, because the account was a real production account with live product data.
• Not claimed Account administration. Blocked by runtime policy — this guide makes no claim that agents can perform it.
• Not claimed Anything on a machine other than the Mac this was proven on. Outloop is at controlled design-partner stage.
• Not claimed That a successful OAuth callback means the connector is ready. It means Google accepted the sign-in — nothing more until a provider request succeeds.

Troubleshooting

Google shows an account chooser

Expected. Outloop asks Google for the chooser on purpose, so a sign-in can never silently reuse whichever account your browser happened to be logged into. Pick the account that owns or can open the client's Merchant Center account — which is often not the account that manages the Google Cloud project.

“Google hasn’t verified this app”

This appears because the OAuth app is your own and has not been through Google's verification. If it is your app and you trust it, expand Advanced and continue. If you do not know who owns the app, stop — that warning is doing its job, and clicking past an unknown app is not a routine step.

Which audience the app uses decides who can get that far at all. An External app in Testing only admits accounts added as Test users. An Internal app only admits accounts inside its Google Workspace organisation. For customer-facing production use, complete Google's verification rather than living in Testing.

The wrong Google account got connected

Use Connect as a different Google account on the connector. It keeps the same Client ID and Client Secret and reopens Google's chooser. The stored token is only replaced once Outloop verifies the new identity is the intended one — if it does not match, Outloop reports the mismatch and keeps the previous credential. Nothing is lost by trying.

A credential that works but sits on the wrong account is deliberately not marked runtime-verified for that workspace. Working and correct are different things.

BACKEND_AUTH_FAILED during connect

Google rejected the sign-in, so the new credential failed Outloop's safe verification. The important part: the previous credential is unchanged. Do not delete the connector, the OAuth app or the workspace as a first move. Check, in this order — that you signed in as the account that can reach the client's Merchant Center account; that the account is admitted by the app's audience (a Test user on an External+Testing app); and that the API is enabled in the right Cloud project. Then try the connect again.

Reconnecting never asked for the Client ID and Secret

Expected. Disconnecting a Google Merchant Center credential does not delete your saved Google OAuth app profile — that is a separate object, kept on purpose so later connectors do not re-enter a Client Secret. Outloop reused it. If you specifically want a different app, pick another saved profile from the Google OAuth app dropdown, or create a new one and save it alongside. This is reuse working, not a stale credential silently retained.

“Copy workspace run prompt” is not available

The Access Profile has not been saved yet. Open the Access Profile, choose the reach and the capabilities, and click Save Access Profile — the run prompt becomes available once the authorization is recorded. OAuth succeeding is not the same as the workspace being authorized, and this is the step that closes the gap.

The connection stops working after about a week

If the OAuth app's audience is External and its publishing status is still Testing, Google expires refresh tokens for that app after roughly seven days. Two honest options: publish the app to In production, or use an Internal audience if everyone signing in is inside your Google Workspace organisation. Publishing may require Google's verification review depending on the scopes the app requests — that is Google's process and its outcome and timing are not ours to promise.

The account list came back empty

Expected in some setups, and not a broken connection — see the note in step 7. Sub-accounts under an advanced account need their own call to enumerate.

A call returns ACCOUNT_ADMIN_BLOCKED

The agent attempted account administration, which is blocked by runtime policy. This is not a configuration problem and cannot be enabled from the agent side.

The sign-in worked but no Merchant account is reachable

The account you chose in Google's chooser signed in successfully but has no access to the client's Merchant Center account. Sign-in proves identity, not reach. Have the client grant that exact address access in Merchant Center, or use Connect as a different Google account to connect as one that already has it.

Rotate or revoke access

• →Move a workspace off an account — change the mapped Merchant account ID and save. The workspace's reach changes immediately; the credential is untouched.
• →Rotate the token — use Re-authenticate on the connector. Same account, fresh authorization.
• →Revoke everything for this connector — remove the Merchant Center credential in Outloop, then revoke Outloop's access for that account at myaccount.google.com/permissions. Do both: removing the local credential does not revoke the grant at Google.
• →Off-boarding a client — also ask them to remove the connected address from their Merchant Center users list. Revoking on your side does not remove the account's standing access on theirs.

Official Google documentation

• →Merchant API reference — the current sub-API surface and request shapes.
• →Merchant API quickstart — enabling the API and the OAuth scope it requires.
• →OAuth app audience and publishing status — Internal vs External, Testing, and Test users.
• →Using OAuth 2.0 to access Google APIs — refresh-token behaviour, including the Testing-status expiry.

Outloop is an independent tool and is not affiliated with or endorsed by Google. See the security model, the Google Ads setup guide, the full guide index, or running agents across client marketing accounts.