Connect a module

Google Tag Manager

Connect exact GTM containers with read-only audit access by default, then grant a separate edit/version/publish bundle only when the workspace needs to build tracking.

1. Choose the permission level

Open Settings → Integrations, choose Google Tag Manager, and start one of two Google OAuth flows.

Audit access requests https://www.googleapis.com/auth/tagmanager.readonly.
Build and publish access also requests tagmanager.edit.containers, tagmanager.edit.containerversions, and tagmanager.publish.

Narrow Google consent

ShopMCP does not request container deletion, account management, or GTM user-management scopes. On Google's granular permissions screen, approve every permission shown for the flow you selected.

2. Select exact containers

ShopMCP enumerates the GTM accounts and containers visible to the Google user. Select one or more containers. Each encrypted connection records the exact account ID, container ID, public ID (for example GTM-ABC123), usage context, Google account, and granted scopes.

You can connect multiple containers for brands, regions, sites, apps, or server-side environments. When reconnecting an existing container, selecting it refreshes that container's OAuth grant instead of creating a duplicate ShopMCP connection.

3. Create a web container when needed

Google's Tag Manager API cannot create GTM accounts. Create and accept terms for a new account in Google Tag Manager first.

With the build-and-publish grant, ShopMCP can create a web container under an existing visible account. Enter the container name and site hostname, review the exact target account, and tick the explicit confirmation. ShopMCP verifies the account again with Google before sending the create request, then connects the returned container identifiers.

Do not blindly retry an uncertain create

If the network ends before Google confirms the response, check the target GTM account for the new container before retrying. This avoids creating a duplicate container after an uncertain provider outcome.

4. Enable ShopMCP's separate write gate

Google OAuth consent is necessary but does not activate write tools by itself. An owner or admin must separately enable GTM write tools for the workspace. Per-connection overrides can narrow write availability further.

A read-only container stays read-only even if the workspace's write gate is on. Reconnect that container with build-and-publish access before asking ShopMCP to change it.

5. Build and verify tracking

Use a dedicated ShopMCP workspace inside GTM for changes. Review the proposed entity diff and source fingerprints before mutation. A production-ready QA sequence includes:

workspace synchronization and conflict checks;
static tag, trigger, variable, ID, naming, duplicate, and consent-order checks;
GTM compile/quick-preview evidence and an exact version snapshot;
browser checks for container presence, data-layer events, consent states, tag firing counts, cookies, and network payloads;
GA4 Realtime or DebugView acceptance for test events and parameters;
explicit publish confirmation followed by live-version readback and another browser/GA4 check.

Configuration QA is not ingestion proof

A valid or compilable GTM workspace does not prove the customer's site emitted the right event or that GA4 accepted it. Browser execution and GA4 readback are separate QA gates.

Troubleshooting

No accounts found — the Google user has no accepted GTM account. Create the account in Google Tag Manager or reconnect with a user who has access.
No containers found — reconnect with build-and-publish access to create a web container under an existing account, or create the container in Google.
Permission required— restart the appropriate OAuth flow and approve every permission shown on Google's granular consent screen.
Write tools remain unavailable— confirm both the container's OAuth grant and ShopMCP's workspace/connection write gates.
Account/container list is slow— ShopMCP intentionally paces GTM requests to respect Google's project-wide quota.