All guides, by feature
Integrations
Connect ad platforms and other data sources, choose which accounts sync, and keep them connected.
At a glance
- Where in Orbit
- Sidebar › Data › Integrations
- Who can use it
- Agency Owners and Admins connect, reauthenticate, delete and map. Everyone else can view.
What it’s for
Integrations is where your data comes in. Each connection signs Orbit in to one platform, such as Google Ads, with a login that can read your accounts. You then choose which accounts to sync and which client each belongs to.
Orbit syncs every connection once a day on its own. What a client sees in their dashboards and reports comes from the accounts assigned to them in Account Mapping.
From the + Add Connection catalog, six platforms send data to reports today: Facebook Ads, Google Ads, LinkedIn Ads, Google Analytics, Shopify and Amazon Marketplace. They’re marked Syncs to reports. Other catalog platforms can be connected, but don’t send data to reports yet.
Guides
Questions
Which platforms send data to reports?
In the + Add Connection catalog: Facebook Ads, Google Ads, LinkedIn Ads, Google Analytics, Shopify and Amazon Marketplace. They’re marked Syncs to reports.
I connected Microsoft Advertising. Why is there no data?
Microsoft Advertising, Snapchat Ads, X (Twitter) Ads and Google Ads Manager can be connected and their accounts mapped, but they don’t send data to reports yet.
Should I connect Google Ads or Google Ads Manager?
Google Ads. Google Ads Manager (MCC) can be connected but doesn’t send data to reports yet.
Why can’t I add a connection?
Only an Agency Owner or Admin can. Others see “Only agency owners and admins can add connections. Ask one of them to connect this platform.”
Connect Google Ads or another ad platformSystem Role: what each one can do
Is there a Sync now button?
No. Orbit syncs every connection once a day on its own. If a connection’s sync failed, Retry on the Dashboard’s Data sync card runs it again.
How often does Orbit sync our data?
Once a day. Each daily sync refreshes the last 7 days, and on Sundays it refreshes the last 90 days.
What does “Needs accounts” mean?
The connection is set up but no accounts are chosen, so Orbit doesn’t sync it. Press Finish setup → on its row and choose them.
What does “Needs clients” mean?
The connection syncs, but some of its accounts have no client, so their data reaches no dashboard or report. Assign them in Account Mapping.
Assign ad accounts to a clientWhen data is missing but nothing failed
Where can I see why a sync failed?
Hover Failed in the Last Sync column in Integrations, read the Failed row on the Dashboard’s Data sync card, or open the connection and check Recent ETL Sync Jobs.
Will reauthenticating lose my accounts or client assignments?
No. It signs the same connection in again; chosen accounts, client assignments and past data stay as they are.
Reconnect a platform that stopped syncingWhat reauthenticating changes
What happens if I delete a connection?
Its performance, CRM and collaboration data and its sync history are removed from every report, permanently. Accounts keep their client in Account Mapping. To fix a broken connection, reauthenticate instead.
Can one ad account belong to two clients?
No. Each account belongs to one client, and that decides where its data appears.
Assign ad accounts to a clientWhat assigning an account does
What happens to data from an account with no client?
It syncs but appears nowhere: not in dashboards, reports or Data chat. Assign the account to a client in Account Mapping.
Assign ad accounts to a clientWhat assigning an account does
I assigned an account. Why is older data missing?
Assigning starts a sync straight away for recent days. Earlier days fill in as Orbit re-syncs them, up to 90 days back with the Sunday sync.
What does “Suggested” mean when I choose accounts?
Orbit pre-filled a client because the client’s name appears in the account’s name. It isn’t saved until you save.
What does Find Accounts do?
It adds accounts already chosen on a connection that are missing from Account Mapping. It doesn’t fetch new accounts from the platform: to add those, open the connection from Integrations.
An account’s name is out of date. How do I refresh it?
In Account Mapping, open the menu and choose Re-check account names from Google/Meta. Despite its label, it refreshes every connection whose accounts you pick from a list. Google Analytics, Shopify and Amazon Marketplace aren’t included.
How many Google Analytics properties can one connection sync?
One. Each Google Analytics connection takes exactly one property ID; Shopify takes one store domain and Amazon Marketplace one Seller ID.
Can Managers and Specialists change connections?
No. They can view connections and their sync status, but only an Agency Owner or Admin can add, reauthenticate, delete or map them.
What is The Trade Desk card in Integrations for?
It stores your agency’s Trade Desk credentials so Claude can use The Trade Desk through Orbit, and so Command Center can check them before a push. In Orbit’s words: “Expose the TTD Kokai API as MCP tools for Claude Code and other agents.”
Save your agency’s Trade Desk credentialsThe Trade Desk credentials and modes
Does Connected on The Trade Desk mean our token works?
No. It means a token is saved. Orbit doesn’t check it with The Trade Desk.
Save your agency’s Trade Desk credentialsThe Trade Desk credentials and modes
How do I change our Trade Desk token?
Paste the new token in TTD API Token and press Update Credentials. Leaving the field blank keeps the current token.
Can I connect a Trade Desk sandbox?
Yes. Set Environment to Sandbox in your Trade Desk credentials.
Can Claude change our Trade Desk campaigns?
Only with Read-only mode switched off: “Writes allowed. Agents may create campaigns, ad groups, etc.” It’s on by default, so agents can only read.
Should I use the Claude.ai connector or an API key for The Trade Desk?
Use the Claude.ai connector if you work in Claude.ai: Orbit recommends it and there’s no key to copy. Use an API key for Claude Code or other tools that read an .mcp.json file.
Connect Claude.ai to The Trade DeskTwo ways to connect Claude to The Trade Desk
Can I see a Trade Desk API key again after creating it?
No. Orbit shows each key once. If you lose it, revoke it and create a new one.
Create a Trade Desk API key for Claude CodeTwo ways to connect Claude to The Trade Desk
What happens when I revoke a Trade Desk API key?
Anything using it starts failing within about 60 seconds. Revoking a Claude.ai connection stops it straight away.
Revoke a Trade Desk key or Claude connectionTwo ways to connect Claude to The Trade Desk
Who can see our Claude.ai connections?
Owners and Admins see and can revoke every Claude.ai connection at your agency. Everyone else sees and can revoke only their own.
Why isn’t The Trade Desk in the Add Connection list?
It has its own card under AI Tools & MCP Servers in Integrations, where you save your agency’s Trade Desk credentials.
Command Center says “TTD-MCP key issued” or “TTD credentials configured” is failing. What do I do?
Both come from The Trade Desk card in Integrations. Save your credentials there, and create a key under MCP API Keys (Claude Code / advanced) if you’ve revoked yours.
Save your agency’s Trade Desk credentialsThe Trade Desk credentials and modes
What does the Google Tag Manager integration do?
It lets Claude work on your Tag Manager containers through Orbit: “Let Claude manage GTM tags, triggers, variables, and publishes for your tracking workflow.” It acts only on the containers your agency allows.
Set up Google Tag Manager for ClaudeGoogle Tag Manager container scope
What does Pending verify mean on Google Tag Manager?
Your container scope is saved, but nobody has pressed I added the SA — mark verified since it last changed. The GTM page calls this “Scope saved · awaiting verification”.
Set up Google Tag Manager for ClaudeGoogle Tag Manager statuses
Why did Google Tag Manager go back to Pending verify?
Someone changed the allowed accounts or containers, which resets verification. Check the service account is on any new container, then mark it verified again.
Does Orbit check that we added the service account in Tag Manager?
No. Marking it verified is your agency’s own confirmation. Make sure the service account is a user on each container first.
Which role should Orbit’s service account have in Tag Manager?
Publish, or Edit if Claude should change tags but never publish. Add it under each container’s User Management.
Set up Google Tag Manager for ClaudeGoogle Tag Manager container scope
Can Claude publish our Tag Manager containers?
Only if Allow publish is on, which it isn’t by default. With it off, publishing always fails.
Can I limit Claude to certain Tag Manager containers?
Yes. Switch on Restrict to specific containers and list them. With it off, Claude can reach every container in the allowed accounts.
Set up Google Tag Manager for ClaudeGoogle Tag Manager container scope
What format do Tag Manager account and container paths use?
accounts/ and the account ID, such as accounts/6034256781, and accounts/6034256781/containers/12345678 for a container. At least one account is required.
Is the Google Tag Manager setup per person?
No. There’s one setup per agency, shared by everyone. Each person connects their own Claude.ai account to it.
Does the Google Tag Manager connector work in Claude Code?
Yes. Once you’ve approved it in Claude.ai, the same connector works in Claude Code without authorizing again.
How do I disconnect Claude from Google Tag Manager?
On the Google Tag Manager page, press Revoke beside the connection under Connected Clients (Claude.ai). Orbit confirms “Connection revoked” and it stops at once.
What does the Performance rows number on a connection count?
All the data the connection has brought into Orbit. It’s named for the source: Days of site data for Google Analytics, Orders for Shopify, Days of sales data for Amazon Marketplace.
Check a connection’s status and sync historyWhat a connection’s page shows
Why doesn’t my connection show a rows count?
Orbit hides it, rather than showing 0, when it doesn’t know where that source’s data goes. Check Recent ETL Sync Jobs instead.
How many syncs does Recent ETL Sync Jobs show?
The last 10, with each one’s status, records, start time and duration.
Check a connection’s status and sync historyWhat a connection’s page shows
Why does a connection’s page keep refreshing?
A sync is running. The page refreshes every 5 seconds for up to 10 minutes, then says “Sync still running” if it hasn’t finished.
How do I add or remove accounts on a connection?
Open the connection with Manage → and press Change on its accounts card. Only Owners and Admins can.
Why does a connection say “Ask an agency admin to finish setting it up”?
No accounts are chosen on it, so it isn’t syncing, and only an Owner or Admin can choose them.
Change which accounts a connection syncsWhen data is missing but nothing failed
Does connecting HubSpot or Salesforce bring CRM data into reports?
No. CRM sources connect, but send nothing to reports. Data chat can answer about them by querying them directly.
Connect HubSpot, Slack or another non-ad sourceWhat each kind of source does in Orbit
What happens when I connect Slack, Gmail or Google Drive?
Orbit saves the connection and shows Connected, with nothing more to set up. These sources don’t send data to reports.
Connect HubSpot, Slack or another non-ad sourceWhat each kind of source does in Orbit
Can I connect a database or data warehouse?
Yes, such as BigQuery, Snowflake or PostgreSQL. There’s no account step, and their data doesn’t reach reports.
Connect HubSpot, Slack or another non-ad sourceWhat each kind of source does in Orbit
How do I find a platform in the Add Connection list?
Type in Search data sources..., or choose a category in All Categories, such as Marketing & Ads or CRM. Look for Syncs to reports on the ones that feed reports.
Does a connection belong to a client?
No. Every connection belongs to your agency. Its accounts are assigned to clients, which decides whose reports their data appears in.
Assign ad accounts to a clientWhat assigning an account does
Can clients connect their own Google Ads or Meta accounts?
No. Your agency connects platforms on clients’ behalf; their portal is read-only.
Is connecting Gmail in my profile the same as adding Gmail in Integrations?
No. Profile › Connections links your own Gmail and Google Calendar to your Mission Control board, and only you see what comes back. Gmail in Integrations is an agency source that doesn’t reach reports.
How it works
Explainer: What each kind of source does in Orbit
Six platforms send data to reports. Other ad platforms can be connected and their accounts saved for later. CRM, messaging, file, database and similar sources connect, but send nothing to reports.
| Source | After you sign in | Reaches reports |
|---|---|---|
| Facebook Ads, Google Ads, LinkedIn Ads | Tick ad accounts from a list | Yes |
| Google Analytics | Type one GA4 property ID | Yes |
| Shopify | Type the store’s .myshopify.com domain | Yes |
| Amazon Marketplace | Type your Seller ID | Yes |
| Other ad platforms, such as Microsoft Advertising, Snapchat, X or YouTube | Choose or type accounts | Not yet. Accounts are saved for when it does. |
| CRM and email marketing, such as HubSpot, Salesforce or Mailchimp | Nothing more to set up | No |
| Messaging and files, such as Slack, Gmail, Google Drive or Google Sheets | Nothing more to set up | No |
| Databases and warehouses, such as BigQuery, Snowflake or PostgreSQL | Nothing more to set up | No |
| Project management, support, payments and finance, such as Jira, monday.com, Zendesk, Stripe or QuickBooks | Nothing more to set up | No |
- Data chat can answer questions about HubSpot, Salesforce, Slack, Google Drive, monday.com and BigQuery by querying them directly, since their data isn’t stored with your ad results.
- Sources that don’t reach reports show Never synced on the Dashboard. Nothing is wrong.
- Every connection belongs to your agency. Its accounts, not the connection, are assigned to clients.
Explainer: What assigning an account does
Each ad account belongs to one client. That decides whose dashboards, reports, pacing and Data chat answers its data appears in.
- Until an account has a client, its data syncs but appears nowhere: not in dashboards, reports or Data chat.
- An account can belong to one client only.
- Assigning an account starts a sync straight away. Earlier days catch up as Orbit re-syncs them, up to 90 days back.
- When you choose accounts on a connection, Suggested means Orbit pre-filled a client because its name appears in the account’s name. Nothing is saved until you save.
- Find Accounts adds accounts already chosen on a connection that are missing from this list. It doesn’t fetch new accounts from the platform: to add those, open the connection from Integrations.
- Re-check account names from Google/Meta refreshes names for every connection whose accounts you pick from a list, not only Google and Meta. Google Analytics, Shopify and Amazon Marketplace aren’t included.
Explainer: What a connection’s page shows
Each connection has its own page, opened with Manage → in Integrations. It shows the connection’s status, how much data it has brought in, its accounts and its recent syncs.
| Section | What it shows |
|---|---|
| Connection Status | Connected, Needs accounts if none are chosen, or the platform’s own status. |
| Rows count | All the data the connection has brought in, named for the source: Performance rows, Days of site data, Orders, Days of sales data, Contacts, Messages or Files. |
| Last ETL Sync | When it last synced, such as “3h ago”, or Running... or Never. |
| Accounts card | The chosen accounts, each with its client or No client. Owners and Admins can Change them. |
| Connection Details | The Data Source and an ID for the connection. |
| Recent ETL Sync Jobs | The last 10 syncs, with Status, Records, Started and Duration. |
| Actions | Reauthenticate and Delete Connection, for Owners and Admins. |
- While a sync runs, the page refreshes itself every 5 seconds, for up to 10 minutes.
- There’s no sync button here, on purpose. The first sync starts when accounts are saved with a client, and the daily schedule takes over from there.
- The rows count is hidden, rather than showing 0, when Orbit doesn’t know where the source’s data goes.
- Anyone at your agency can open the page. Only Owners and Admins can change accounts, reauthenticate or delete.
Explainer: What each sync status means
Each connection has a sync status: on the Dashboard’s Data sync card, and in short in the Last Sync column in Integrations. Synced means it finished a sync in the last 24 hours. Failed and Stale are the ones to act on.
| Status | What it means | What to do |
|---|---|---|
| Synced | Finished a sync in the last 24 hours. | Nothing. |
| Syncing | A sync is running now. | Wait for it to finish. |
| Stale | Its last finished sync is more than 24 hours old. | Open the connection and check its recent syncs. |
| Failed | Its latest sync failed. | Press Retry. If it fails again, reauthenticate. |
| Never synced | It hasn’t synced yet, usually because no accounts are chosen. | Choose its accounts. |
- The Last Sync column shows a time such as “3h ago”, Syncing…, Failed or Never. Hover Failed to read the error.
- Errors are shown as the platform reported them, in the platform’s own words.
- Sync health is the share of your connections that are Synced. Failed and Stale count as issues to review. Never synced lowers the percentage without counting as an issue.
- The “Data updated” badge shows the oldest last sync among your Synced connections, so it’s only as fresh as your least fresh data.
Limits: How often Orbit syncs, and its limits
Orbit syncs every connection once a day on its own. There’s no Sync now button: the only way to sync sooner is Retry on a connection that failed.
- Each daily sync refreshes the last 7 days, so changes the platform makes to recent days come through.
- On Sundays, the sync refreshes the last 90 days instead. History older than that isn’t refreshed on its own; email support@orbit.group if you need it.
- A connection’s first sync starts as soon as its accounts are saved with a client.
- In the + Add Connection catalog, six platforms send data to reports: Facebook Ads, Google Ads, LinkedIn Ads, Google Analytics, Shopify and Amazon Marketplace. They’re marked Syncs to reports.
- Other catalog platforms, such as Microsoft Advertising, Snapchat Ads, X (Twitter) Ads and Google Ads Manager, can be connected but send no data to reports yet.
- Retry shows on the Dashboard’s Data sync card next to a connection that failed. Anyone at your agency can press it.
Explainer: Why a connection stops syncing
Orbit reads your data through the login used to connect the platform. When that login can no longer reach an account, syncs fail until someone signs in again.
It usually comes down to one of these:
- The login’s password changed, or its sign-in was revoked or expired on the platform’s side.
- The login lost access to an ad account, or its permissions on it were reduced.
- The person whose login it is left your agency and their account was closed.
- The ad account itself was closed or removed.
Prevention: Keep connections from breaking
A connection is only as reliable as the login behind it. These habits keep it signed in.
- Connect with a login your agency will keep, not one tied to someone who might leave. If that login goes, every account on the connection stops syncing.
- When the person who connected a platform leaves or changes their password, reauthenticate it with a current login straight away.
- Keep that login’s access to each ad account on the platform. Removing it there stops the sync here.
- Glance at the Sync health tile on your Dashboard. A broken connection shows as Failed or Stale within a day.
- Finish setup on every connection, so nothing sits at Needs accounts or Needs clients.
- Fix a broken connection by reauthenticating, never by deleting it.
Explainer: Personal connections compared with agency integrations
Integrations holds your agency’s connections, which feed everyone’s dashboards and reports. Profile › Connections holds your own Gmail and Google Calendar, which feed only your own Mission Control board.
| Integrations | Profile › Connections | |
|---|---|---|
| Belongs to | Your agency | You |
| Sources | Ad platforms, analytics, ecommerce, CRM and more | Gmail and Google Calendar |
| Used for | Client dashboards, reports, pacing and Data chat | Your own Mission Control board |
| Who sees what comes back | Everyone at your agency, through dashboards and reports | Only you: not your admin, not your agency owner |
| Who can connect | Owners and Admins | Anyone, at agencies where Mission Control is switched on |
- Gmail added from + Add Connection is a separate, agency-level source, and it doesn’t reach reports.
Explainer: System Role: what each one can do
A System Role sets what someone can change in Orbit. Owners and Admins can do almost everything. Managers and Specialists work on plans, reports and pacing, and can view clients and connections without changing them.
Owner and Admin have the same permissions, with three exceptions. Only an Owner can make someone an Owner. The last Owner can’t be demoted or removed, so your agency always has one. And only an Admin can choose a client’s Trade Desk advertiser and push to The Trade Desk.
A System Role decides what someone can do. Which clients they can see is set separately, in their Client Access.
| Task | Owner and Admin | Manager | Specialist |
|---|---|---|---|
| Add and edit clients | Yes | View only | View only |
| Connect, reauthenticate or delete platforms | Yes | View only | View only |
| Assign ad accounts to clients | Yes | View only | View only |
| Invite teammates and change their roles | Yes | No | No |
| Branding, report templates and agency goals | Yes | No | No |
| Choose what clients see in their portal | Yes | Yes | No |
| Create and edit media plans | Yes | Yes | Yes |
| Delete, archive or restore media plans | Yes | Yes | No |
| Change taxonomy | Yes | Yes | No |
| Build custom reports | Yes | No | No |
| Build AI Reports, where your agency has them | Yes | Yes | Yes |
| Send reports to clients | Yes | Yes | No |
| Set pacing targets and budgets | Yes | Yes | Yes |
| See margin and profit in pacing | Yes | No | No |
| Ask Data chat | Yes | Yes | Yes |
Explainer: When data is missing but nothing failed
A connection can be healthy and still send nothing to a client’s dashboard. Usually an account isn’t chosen, has no client, or comes from a platform that doesn’t sync to reports yet.
- Needs accounts: the connection has no accounts chosen, so Orbit skips it. Press Finish setup → and choose them.
- Needs clients: it syncs, but some accounts have no client, so their data reaches no dashboard, report or Data chat answer. Assign them in Account Mapping.
- The platform doesn’t sync to reports yet. Only platforms marked Syncs to reports do.
- The account was assigned recently, so only recent days have filled in. Earlier days follow as Orbit re-syncs them.
- A teammate can’t see the client at all. Check their Client Access in Team.
Explainer: What reauthenticating changes
Reauthenticating signs the same connection in to the platform again. Its chosen accounts, client assignments and data stay as they are.
- It opens the platform’s sign-in for this connection, then brings you back to its page in Orbit.
- Sign in with a login that can reach the connection’s ad accounts. A different login works if it has access to the same accounts.
- It doesn’t start a sync by itself. Press Retry on the Dashboard to sync now, or wait for the next daily sync.
- Days missed while it was down fill in with the next sync if they’re within the last 7 days. Longer gaps fill in with the Sunday 90-day sync.
Limits: Reauthenticate, don’t delete
Deleting a connection permanently removes its data from every report, and it can’t be undone. To fix a broken connection, reauthenticate it instead.
- Deleting removes the connection’s performance data, its CRM and collaboration data, and its sync history.
- Accounts keep their client in Account Mapping.
- Connecting again syncs from scratch, and history older than 90 days won’t come back on its own.
Explainer: The Trade Desk credentials and modes
Your agency saves one set of Trade Desk credentials in Orbit. Claude uses them through Orbit’s Trade Desk server, and Command Center checks them before a push to The Trade Desk.
| Field | What it does |
|---|---|
| TTD API Token | Your Trade Desk API token. Stored encrypted and never shown again. When updating, leave it blank to keep the current one. |
| Partner ID | Required. Your Trade Desk partner ID. |
| Default Advertiser ID (optional) | An advertiser to use by default. |
| Environment | Production or Sandbox. |
| Read-only mode on | “Writes blocked. Agents can read TTD data only.” This is the default. |
| Read-only mode off | “Writes allowed. Agents may create campaigns, ad groups, etc.” |
| Optional · DMP workflows credential | A separate credential that only the DMP toolset needs. |
- Connected means a token is saved. Orbit doesn’t check it with The Trade Desk.
- There’s one set per agency. Saving again replaces it for everyone.
- Once saved, the page shows the Partner, Environment, Mode and when they were Last updated.
- Command Center’s push checks include TTD credentials configured and TTD-MCP key issued.
Explainer: Two ways to connect Claude to The Trade Desk
Claude.ai connects through a custom connector that you approve with your Orbit login. Claude Code and other tools use an API key you create in Orbit.
| Claude.ai connector | API key | |
|---|---|---|
| Best for | Claude.ai. Orbit recommends it. | Claude Code and other tools that read an .mcp.json file. |
| How you connect | Add a custom connector in Claude.ai and approve it. | Create a key in Orbit and paste it into .mcp.json. |
| Listed under | Connected Clients (Claude.ai) | MCP API Keys (Claude Code / advanced) |
| When revoked | Stops at once. The person re-authorizes from Claude.ai’s connector settings. | Requests start failing within about 60 seconds. |
| What Claude can do | Set by Read-only mode. | Set by Read-only mode. |
- Each API key is shown once, when you create it. If you lose it, revoke it and create another.
- Keys last until they’re revoked. The table lists each one’s Prefix, Created date and when it was Last used.
- The approval screen in Claude.ai says what Claude may do: “Read and modify TTD data”, or “Read TTD data (agency is in read-only mode)”.
- Owners and Admins see and can revoke every Claude.ai connection at your agency. Everyone else sees only their own.
Explainer: Finding a source in the catalog
+ Add Connection opens Add a Data Source, a catalog of the sources Orbit can connect. Search it or filter by category, and look for Syncs to reports on the sources that feed reports.
- Search data sources... matches a source’s name and its description.
- The category filter starts at All Categories. Categories include Marketing & Ads, Analytics, CRM and Messaging.
- Only six sources carry Syncs to reports: Facebook Ads, Google Ads, LinkedIn Ads, Google Analytics, Shopify and Amazon Marketplace.
- The steps along the top, Connect Platform, Choose Accounts and Sync Data, show where you are.
- Only Owners and Admins see Connect. Everyone else sees “Only agency owners and admins can add connections. Ask one of them to connect this platform.”
- The Trade Desk and Google Tag Manager aren’t in the catalog. They’re cards under AI Tools & MCP Servers in Integrations.
Explainer: Google Tag Manager container scope
Orbit’s shared GTM service account can act only on the accounts and containers your agency lists under Container scope. Anything outside that scope is rejected.
| Setting | What it does |
|---|---|
| Allowed GTM accounts | The Tag Manager accounts Claude may reach, each written accounts/ and its ID. At least one is required. |
| Restrict to specific containers | Off: every container in those accounts. On: only the containers you list, written accounts/…/containers/…. |
| Read-only | On by default. Agents can read GTM data but can’t change tags, triggers, variables or workspaces. |
| Allow publish | Off by default. While it’s off, publishing a container always fails. |
- In Tag Manager, give the service account the Publish role on each container, or Edit if Claude should change tags but not publish.
- Find account and container IDs in Tag Manager’s admin pane.
- The approval screen in Claude.ai sums up the scope, for example “Read and modify GTM data · 1 account, all containers in scope”.
- Once authorized, the Claude.ai connector also works in Claude Code.
Explainer: Google Tag Manager statuses
Google Tag Manager shows Connected once your agency has saved which containers Claude may use and marked Orbit’s service account as added. The Integrations card and the GTM page word the earlier steps differently.
| Integrations card | GTM page | What it means |
|---|---|---|
| Not connected | Not configured | No container scope saved yet. |
| Pending verify | Scope saved · awaiting verification | Scope saved, but nobody has marked the service account as added since the scope last changed. |
| Connected | Connected | Scope saved and marked verified. |
- Marking it verified is your agency’s own confirmation. Orbit doesn’t check Tag Manager to see the service account was added.
- Changing the allowed accounts or containers sets it back to Pending verify. Changing Read-only or Allow publish doesn’t.
- There’s one Google Tag Manager setup per agency, shared by everyone.