Data sources overview
What the data sources page does, the connection matrix for every source, what each state means, and the actions available.
Overview#
The data sources page (`/dashboard/data-sources`) shows each source's connection state and bound value, with entries to authorize or disconnect. The connection model is "account-level authorization + site-level binding".
- Connection status reads real site-record fields (such as `ga4_property_id`, `gsc_site_url`, `adsense_client_id`).
- Authorization uses a one-time connect ticket then a full-page redirect; disconnect goes through `auth/disconnect`.
- There is no plan gating.
Connection matrix#
Each source's state, permission, bound value and latency:
| Source | State | Permission | Bound value | Latency |
|---|---|---|---|---|
| GA4 | Connected / unbound | analytics.readonly (read) | GA4 property | 24-48 hours |
| GSC | Connected / unbound | webmasters (read + write) | GSC property | 1-2 days |
| AdSense | Connected / unbound | adsense.readonly (read) | Account `pub-xxx` | 24-48 hours |
| GTM | Connected / unbound | tagmanager.readonly (read) | Container `accounts/x/containers/y` | Read on demand |
| Bing | Connected / unbound | webmaster.readonly (read) | Bing site | Daily |
| Cloudflare | Connected / unbound | API Token (read) | Cloudflare zone | Near realtime (history 14/30 days) |
| PageSpeed Insights | Always available | No authorization | — | ~6 hours |
State meanings#
- Connected: the site has bound a concrete resource for that source and can fetch data.
- Unbound: the account is authorized but the site has not selected/bound a resource yet — pick one in Settings.
- Invalid: the authorization token has expired or lacks scope, and needs re-authorization.
- Always available: does not depend on account authorization; usable as long as the server has outbound access (PSI).
Common error codes when fetching fails:
| Code | Meaning |
|---|---|
| CONNECTION_REQUIRED | 403, that service is not connected |
| GOOGLE_AUTH_REQUIRED | 503, token expired, re-authorization required |
| TOKEN_REFRESH_FAILED | 503, token refresh failed |
| GA4_NOT_BOUND / NO_GA4_PROPERTY | No GA4 property selected (unbound) |
| NO_GSC_PROPERTY | GSC property not bound |
| GSC_PERMISSION_DENIED | 403, wrong property type or no permission |
| NO_ADSENSE_ACCOUNT | AdSense account not bound |
| ADSENSE_MULTIPLE_ACCOUNTS | Multiple AdSense accounts; a manual pick is required |
| PSI_UNAVAILABLE_OR_QUOTA | Quota exhausted or timed out |
| UPSTREAM | 502, upstream error |
| PLAN_REQUIRED | 403, plan too low |
| BILLING_NOT_CONFIGURED | 503, billing not configured |
| AI_NOT_CONFIGURED | 503, model not configured |
| CF_TOKEN_INVALID | 400, invalid Cloudflare Token |
Available actions#
Actions available per source, by state:
- Re-authorize: after a scope upgrade or an expired token, run authorization again (GSC URL Inspection needs write scope).
- Change binding: pick another resource in Settings — no re-authorization needed.
- Disconnect: only that service's grant is revoked; Bing / Cloudflare are fully independent and never affect other sources.
Note: AdSense is account-level: a single account is selected automatically and multiple accounts must be picked manually. Cloudflare requires the site to be hosted on Cloudflare to bind a zone.
Related docs#
- Site connections & authorization: /connections
- API keys & API access: /api-keys
- Plans & feature gating: /plans