What a connection is
A connection is a saved login to another service, kept at the company level. Lens, AutoTag, Observer, Echo and other modules ask you to pick a connection instead of storing credentials themselves. Credentials stay on the TagPipes server and are never sent back to your browser; even the edit page does not show a stored secret.
Before you start
You need edit access to the company to add, edit, re-authorize or remove connections. For an OAuth connection, sign in to the provider with an account that can see the ad accounts, properties or containers you want TagPipes to use.
Add a connection
- On Companies, click the gear icon next to the company, then click Security & Access.
- Click Add Connection.
- Under Choose Connection Type, pick one of the types below and fill in its form.
- For OAuth, click Connect provider Account and approve access on the provider's page. For every other type, click Save Connection.
The new connection appears on the Security & Access list.
Connection types
| Type | Use it for | You enter |
|---|---|---|
| OAuth | Google, Meta, LinkedIn, Pinterest, Reddit or TikTok accounts. Tokens refresh automatically where the provider allows | You sign in on the provider's page |
| API Key | A static key for a third-party service | Connection Name, Provider, API Key, Header Name (default X-API-Key) |
| Bearer Token | A pasted access token, for example a Meta Conversions API token or an OpenAI key | Connection Name, Provider, Token, Token Expires |
| Username / Password | Services that need a login | Connection Name, Provider, Username, Password |
| Service Account | Service-to-service access with a JSON key file, for example Google | Connection Name, Provider, Service Account Key (JSON) |
| Adobe Analytics | Lens Adobe Analytics tables | Client ID, Client Secret and Organization ID from an Adobe Developer Console project |
| Olo | Lens Olo tables | Client ID and Client Secret from your Olo Developer Portal project, and Environment (Production or Sandbox) |
| SFTP | A destination for Lens exports | Host, Port (default 22), Username, a Private key (recommended) or Password, and an optional Default Remote Path |
Every type also takes an optional Description.
OAuth providers
| Provider | What TagPipes asks for | Used by |
|---|---|---|
| Google Analytics, Google Tag Manager containers and Google Ads | Lens, Observer, AutoTag, Echo | |
| Meta | Read access to your ad accounts | Lens reporting |
| Conversions and ads reporting | Echo conversions, reporting | |
| Ads read and write | Echo conversions, reporting | |
| Ads conversions | Echo conversions | |
| TikTok | Ad account details (time zone, currency) and reporting. Read-only: TagPipes never creates or changes campaigns | Lens reporting |
Echo's Meta and TikTok conversion destinations do not use these OAuth connections. Meta conversions use a pasted token, such as a Meta System User token, saved as a Bearer Token connection. TikTok conversions use the access token from TikTok Events Manager.
For Olo, the project must have Signature Authorization enabled. Kiosk keys do not work, and only the project owner can see the Client Secret.
The Security & Access list
| Column | Shows |
|---|---|
| Name | The connection name and description |
| Type | OAuth, API Key, Bearer Token, Username / Password, Service Account, OAuth Server-to-Server (Adobe), Signature (HMAC) (Olo) or SFTP |
| Account | The provider account email for OAuth, otherwise a short hint of the credential |
| Status | active, expiring (expires within 14 days), expired, revoked or error |
| Expires | Days until the token expires, or "Expired 3 days ago". "Unknown" for a bearer token with no expiry date. -- for connections that renew themselves |
| Access | Restricted or Unrestricted (see below) |
| Connected | When the connection was added |
Record when a pasted token expires
A bearer token is never refreshed, so TagPipes cannot find out when it stops working. It would keep showing as healthy while every request fails. Enter the last date it is valid in Token Expires when you add it, or later on its edit page, and the list warns you 14 days ahead. Typical lifetimes: LinkedIn tokens 60 days from issue, Meta user tokens 60 days, Meta System User tokens do not expire. Leave the date blank only if the token really does not expire.
Restrict which accounts a connection can reach
If the account you connected can see more than this company should, such as a Google Ads manager (MCC) account, limit it:
- Click the edit icon on the connection.
- Tick Enable account restrictions.
- List the allowed IDs, one per line, in GA4 Properties (for example
properties/123456789), GTM Containers (accounts/111/containers/222), Google Ads Customers (customers/123-456-7890) or Meta Ad Accounts (act_123456789). - Click Save Changes.
With restrictions on, modules can only use the connection for the listed resources. A connection to the company's own account usually needs no restrictions.
Re-authorize an OAuth connection
Click the refresh icon (Re-authorize) on the list, or Re-authorize on the edit page. You go through the provider's consent page again, and the connection keeps its identity, so every table, project and destination that uses it keeps working. Sign in with the same account the connection was created with.
Re-authorize when a token has expired or been revoked, or when TagPipes needs a permission the connection did not have when it was created.
Remove a connection
Click the trash icon (Disconnect) and confirm. Modules that use the connection lose access to the service.
Troubleshooting
| Problem | Cause | Fix |
|---|---|---|
| "OAuth authorization was denied or failed" | You cancelled on the provider's page, or the provider refused | Try again with an account that has access |
Status is expiring or expired | The token is near or past its expiry | OAuth: re-authorize. Bearer token: create a new token at the provider, add it as a new Bearer Token connection, switch the items that used the old one, then remove the old one |
| Echo's Google Ads destination is refused permission on an older Google connection | Google connections made before August 2026 lack the permission Echo now uses to send Google Ads conversions | Re-authorize the Google connection |
| A module cannot see an account you expect | The connection has restrictions that leave it out, or the connected login cannot see it | Edit the restrictions, or re-authorize with a login that has access |
| "Only OAuth connections can be re-authorized" | Re-authorize was used on another type | Edit the connection and enter new credentials instead |