Connect Google Tag Manager
Connecting Google Tag Manager lets MarqIQ create its tracking tag in your container, so nobody has to edit the website. The access token you paste lasts about an hour and MarqIQ cannot renew it, so connect shortly before you deploy rather than days ahead. If you would rather paste the snippet into your site once and be done, install the tracking script by hand instead.
Before you start
Connect shortly before you deploy
A Google access token lasts about an hour. Paste the refresh token as well and MarqIQ renews it for you — the connect screen tells you whether renewal is switched on for this workspace. Where it is not, treat GTM as a deploy-it-now connection: connect, deploy, publish in GTM, and paste a fresh token next time.
The Refresh Token field does nothing
A Google access token from the OAuth Playground expires after roughly 60 minutes. MarqIQ redeems the refresh token you paste when Google refuses the expired one, and saves the new token — so the connection keeps working. Fill in Refresh Token (optional) blank. Everything you have already deployed keeps running — the token only governs whether MarqIQ can push a new change.
Plan required
Connecting works on every plan. The one-click deploy from Script & Deploy needs Pro or above. On Starter, connect GTM if you like, then copy the script from that screen and add it to your site or your container yourself.
Permissions required
You need a Google account with edit rights on the GTM container, and the Tag Manager API enabled in a Google Cloud project you can use. MarqIQ never publishes your container, so publish rights are not required.
- Your GTM Account ID — in Tag Manager, go to Admin then Account Settings. Open tagmanager.google.com
- Your Container ID — either the public code that looks like GTM-XXXXXX, shown at the top of the container, or the numeric id under Admin then Container Settings. MarqIQ accepts either.
- A Google OAuth access token that begins with `ya29.`, from developers.google.com/oauthplayground
Get a Google access token
MarqIQ does not run the Google sign-in flow for you, so you generate the token yourself and paste it in.
Enable the Tag Manager API in your Google Cloud project.
Open console.cloud.google.com/apis/library/tagmanager.googleapis.com and enable it on the project you are using. Without this every request comes back as a 403, whatever else is correct.
Create OAuth 2.0 credentials in that same project.
You need the Client ID and Client Secret in the next step. Do not paste either of them into MarqIQ — they generate the token, they are not the token.
Open the Google OAuth 2.0 Playground at developers.google.com/oauthplayground
Open the gear icon and tick Use your own OAuth credentials.
Paste your Client ID and Client Secret into the two fields that appear.
Authorise `tagmanager.readonly` and `tagmanager.edit.containers`.
Read-only alone connects, because every check MarqIQ makes at connect time is a read — the failure arrives the first time you press Deploy. MarqIQ never asks for the publish scope and never sends it, so do not grant it.
Exchange the authorisation code for tokens.
Copy the access token. It starts with `ya29.`
Do not copy the Client ID or the Client Secret. MarqIQ checks for both and tells you which one you pasted, because it is the commonest mistake here.
Connect it in MarqIQ
Go to Integrations and choose Google Tag Manager.
Paste the token into Access Token.
Paste your account id into GTM Account ID and your container id into Container ID.
Click Connect GTM.
MarqIQ checks the credentials against Google straight away rather than saving them and failing later. If you gave a GTM-XXXXXX code, it looks the container up and stores the numeric id it needs for everything afterwards.
If GTM is already connected the button reads Update connection instead.
Tip
If you typed a GTM-XXXXXX code and it is not in that account, the error lists every container that is, so you can see whether you have mixed up two accounts. If you typed the numeric id, you get Google’s "not found" and the Admin then Account Settings screen named for you. MarqIQ reads only the first page of a long container list, so a code that is rejected although you can see the container is a reason to paste the numeric id instead.
What MarqIQ can do once it is connected
- Create or update one tag in your container, named MP Unified Tracking, firing on the All Pages trigger.
- Nothing else. It does not read, change or remove any other tag, trigger or variable.
- It never publishes your container. You review the change in GTM and publish it yourself.
Note
The tag is written into the first workspace Google returns, which is not always the one called Default Workspace. There is no workspace picker, so if your team works in several GTM workspaces, check which one it landed in before you publish.
Take care
Replacing an existing MP Unified Tracking tag sends the whole tag, not a merge. Anything you set on it by hand in Tag Manager — a blocking trigger, an exception, a folder, a priority, a note, a paused state — is not in what MarqIQ sends.
If it did not work
The token was accepted this morning and is rejected now
Why: The access token expired and MarqIQ could not renew it — either no refresh token was stored, or renewal is not switched on for this workspace. The connect screen says which.
Fix: Generate a fresh access token at developers.google.com/oauthplayground, paste it into Access Token, and click Update connection. Nothing stops this recurring: a fresh token before each deploy is how the GTM connection works.
"That looks like an OAuth Client ID, not an access token"
Why: You pasted the Client ID — the value ending in `.apps.googleusercontent.com` — instead of the token it is used to generate. A value beginning `GOCSPX-` is the Client Secret, and gets the same treatment.
Fix: Go back to the Playground, exchange the authorisation code, and copy the access token that starts with `ya29.`
Google denied access (403)
Why: Usually the Tag Manager API is not enabled in your Cloud project. It can also mean the token was authorised without the Tag Manager scopes, or that this Google account has no access to the GTM account.
Fix: Enable the Tag Manager API at console.cloud.google.com/apis/library/tagmanager.googleapis.com, then generate a new token with the Tag Manager scopes granted. Check in Tag Manager that the account you authorised with appears under Admin then User Management.
Account or container not found (404)
Why: The Account ID is wrong. The container number is numeric too, so it gets pasted here by mistake.
Fix: In Tag Manager, open Admin then Account Settings and copy the Account ID from there.
The connection succeeded but the deploy is refused for your plan
Why: One-click deploy into GTM is a Pro feature. Connecting is not, so a Starter workspace can connect and then be refused at the last step.
Fix: Move to Pro or above, or copy the script from Script & Deploy and add the Custom HTML tag in Tag Manager yourself. The script itself is served on every plan.
The deploy answers "No GTM workspace found"
Why: The deploy looks for a workspace before it reads what Google said, so an expired token is reported as a missing workspace.
Fix: Paste a fresh `ya29.` token and click Update connection before you go looking at your workspaces.
Next steps
Related articles
Was this article helpful?