RankEngineRankEngine Help

"Reauthorize Google" banner — what to do

If Settings shows a "Reauthorize Google Search Console" banner (different from the cold-start "Connect Google Search Console" CTA), it means Google has invalidated your refresh token.

Why this happens

  • You changed your Google account password.
  • You revoked third-party app access at https://myaccount.google.com/permissions.
  • Google's OAuth refresh token expired (rare; tokens are typically long-lived).
  • Google detected suspicious activity on your account.

RankEngine encrypts your tokens at rest with AES-256 (per CLAUDE.md ENCRYPTION_KEY rotation policy). When the token can't be decrypted or Google rejects it, we flip you into the reconnect_required state and surface the banner.

How to fix

  1. Click the "Reauthorize Google" button in the banner.
  2. Google's consent screen opens — sign in with the same account that originally connected.
  3. Approve the same scopes.
  4. Banner disappears. Your tracked properties + sitemaps re-sync within 60 seconds.

What if I want to switch Google accounts?

  1. First disconnect: Settings → Google Tools → Search Console → Disconnect.
  2. Then re-connect with the new account.

⚠️ Note: tracked keywords are preserved across reconnects. Sitemap submission history is preserved. Only the OAuth token changes.

What if I only want to disconnect ONE service?

Phase 811 added per-service disconnect. Each Google service has its own "Disconnect" button:

  • Settings → Google Tools → Search Console tab → "Disconnect Search Console" (keeps GA4 + MC connected)
  • Settings → Google Tools → Analytics tab → "Disconnect Analytics" (keeps GSC + MC connected)
  • Settings → Google Tools → Shopping tab → MC disconnect (keeps GSC + GA4 connected)

The OAuth token stays intact — only the per-shop service link row is removed. You can re-pick a different property/site/account via the existing picker without re-running OAuth.

Use this when you want to (e.g.) point GA4 at a different property without losing your GSC site selection.

What if reauthorization keeps failing?

Three things to check:

  1. GSC property ownership — the new account must own the same property in Google Search Console. We can't switch you to a property the new account doesn't own.
  2. API enabled — Google Search Console API must be enabled on the project. RankEngine uses its own GCP project, so this is on us, not you.
  3. Country restrictions — some countries restrict OAuth flows. If you're in a restricted region, contact us.

Why does this exist as a separate banner from "Connect Google"?

Phase 174 (in the changelog) split these states. Pre-phase-174, the same UI handled both "never connected" and "needs reauth" — confusing and led to merchants clicking through full OAuth on every transient hiccup. Now they're distinct: the "never connected" CTA opens a fresh OAuth; the "Reauthorize" banner does a same-account re-grant.

Related