Privacy & Security
What Search Console data can GSC PAP access?
GSC PAP requests the webmasters.readonly OAuth scope - the same read-only level you would grant to any third-party Search Console viewer. Specifically we can read your verified site list, search analytics (clicks, impressions, CTR, position by query, page, country, device, date), sitemap submission status, and URL inspection results. This is exactly the data you see in your own Search Console UI.
We cannot write, modify, or delete anything in your Search Console: not sites, not sitemaps, not indexing requests, not anything. The OAuth scope we request technically excludes write operations, so even if our service were compromised, an attacker could not change your Search Console state. The worst case is read-only data exposure - which is why we encrypt every refresh token at rest with AES-256-GCM.
Beyond what Google provides natively, GSC PAP keeps a Personal Archive of your data so you can query beyond Google's 16-month native window. Your archive is private to your account; no other GSC PAP user can see it. See our Privacy Policy for the full storage and retention details.
Related questions
All questionsPrivacy & Security
How do I revoke access?
You have three independent ways to revoke. First, revoke a single MCP token from /account/tokens - this kills only that bearer, leaving other tokens (e.g. on different machines) working. Useful if you suspect one token has been exposed but want to keep using GSC PAP elsewhere.
Privacy & Security
Can other users see my data?
No. Your Search Console data, OAuth tokens, MCP sessions, archive, and tool call history are all isolated to your user account in our database. Every query passes through bearer-token authentication that resolves to a specific user, and every database query scopes results by user_id. There is no UI, API endpoint, or feature that exposes one user's data to another user.
Setup
Do I need a Google Cloud project to use GSC PAP?
No. The whole reason GSC PAP exists is to remove the Google Cloud setup step. When you sign in with Google through gscpap.com, you grant permission to our OAuth client (which we registered with Google one time). We then call the Search Console API on your behalf using your refresh token. You never touch the Google Cloud Console.
Skip the GCP project. Just sign in. Ready to plug this into Claude or Cursor? Sign in with Google, copy a token, paste a config block. ~60 seconds.
Sign in with Google