--- title: "What Search Console data can GSC PAP access? · GSC PAP" source: https://gscpap.com/faq/what-data-does-gsc-pap-access updated: 2026-10-27 --- [All questions](https://gscpap.com/faq) Privacy & Security # What Search Console data can GSC PAP access? By the [GSC PAP team](https://gscpap.com/about) · Updated October 27, 2026 GSC PAP requests the webmasters.readonly OAuth scope - the same read-only level you would grant to any third-party Search Console viewer. Specifically we can read your verified site list, search analytics (clicks, impressions, CTR, position by query, page, country, device, date), sitemap submission status, and URL inspection results. This is exactly the data you see in your own Search Console UI. It also has the same gaps: Google leaves anonymized queries out of query rows in both the UI and the API, so GSC PAP cannot reveal them either. If you also connect Google Analytics, GSC PAP holds the analytics.readonly scope as well, and any Analytics data it keeps for you follows the same rules as your archive. We cannot write, modify, or delete anything in your Search Console: not sites, not sitemaps, not indexing requests, not anything. The OAuth scope we request technically excludes write operations, so even if our service were compromised, an attacker could not change your Search Console state. The worst case is read-only data exposure - which is why we encrypt every refresh token at rest with AES-256-GCM. Beyond what Google provides natively, GSC PAP keeps a Personal Archive of your data. When you sign in it automatically copies the 16 months Google still has for every property you can read, then adds each new day, so your history keeps growing past Google's 16-month window. Your archive is private to your account; no other GSC PAP user can see it. See our Privacy Policy for the full storage and retention details. ## Related questions [All questions](https://gscpap.com/faq) [ Privacy & Security ### How do I revoke access? You have three independent ways to revoke. First, revoke a single MCP token from /account/tokens - this kills only that bearer, leaving other tokens (e.g. on different machines) working. Useful if you suspect one token has been exposed but want to keep using GSC PAP elsewhere. ](https://gscpap.com/faq/how-to-revoke-access)[ Privacy & Security ### Can other users see my data? No. Your Search Console data, OAuth tokens, MCP sessions, archive, and tool call history are all isolated to your user account in our database. Every query passes through bearer-token authentication that resolves to a specific user, and every database query scopes results by user_id. There is no UI, API endpoint, or feature that exposes one user's data to another user. ](https://gscpap.com/faq/can-other-users-see-my-data)[ Setup ### Do I need a Google Cloud project to use GSC PAP? No. The whole reason GSC PAP exists is to remove the Google Cloud setup step. When you sign in with Google through gscpap.com, you grant permission to our OAuth client (which we registered with Google one time). We then call the Search Console API on your behalf using your refresh token. You never touch the Google Cloud Console. ](https://gscpap.com/faq/do-i-need-a-google-cloud-project) ### See every tool GSC PAP exposes 36 MCP tools across 9 SEO-intent categories. Each tool is deep-linkable. [Browse the full catalog](https://gscpap.com/tools) **Skip the GCP project. Just sign in.** Ready to plug this into Claude or Cursor? Sign in with Google, copy a token, paste a config block. ~60 seconds. [Sign in with Google](https://app.gscpap.com/login) Did this answer your question? If not, email [support@gscpap.com](mailto:support@gscpap.com) and we will revise.