Authenticate to Google, Adobe and Matomo APIs

🔍 Intro

Let’s say you want to plug into your analytics tool — Google Analytics 4, Adobe Analytics, or Matomo — and pull data through their API.
The naive approach?

“I’ll just call the API endpoint and get the data.”

❌ Not gonna happen.

➡️ No serious API gives you access without authentication.
You need to prove who you are — and what you’re allowed to do.

Let’s break down how authentication works for each major platform.

🟢 Google Analytics API (GA4 Data API)

Auth methods:

OAuth2 (for user-driven flows)
Service Account + JWT (for server-to-server / automation use cases)

Typical flow with a service account:

Create a Google Cloud project
Enable the Analytics Data API
Create a Service Account
Grant it access to your GA4 property as a Viewer
Download the JSON key file
Use a library like google-auth to generate a token

curl -X POST https://analyticsdata.googleapis.com/v1beta/properties/XXXXX:runReport \
-H "Authorization: Bearer ya29.a0AfH6SMXXXXX" \
-H "Content-Type: application/json" \
-d @body.json

📘 Official doc: https://developers.google.com/analytics/devguides/reporting/data/v1

🔵 Adobe Analytics API (via the Adobe Developer Console)

Auth methods:

OAuth Server-to-Server (client credentials) for automation, OAuth User for user-driven flows. Service Account (JWT) credentials reached end of life on June 30, 2025 and no longer work.
You’ll need: client_id, client_secret, the scopes of your credential, and your org ID (x-gw-ims-org-id header on API calls)

OAuth Server-to-Server flow:

Set up a project in the Adobe Developer Console
Add the Analytics API to the project
Configure access (product profiles, sandboxes, scopes)
Add an OAuth Server-to-Server credential to the project
Request an access token from Adobe IMS with your client ID and secret

curl -X POST 'https://ims-na1.adobelogin.com/ims/token/v3' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}&grant_type=client_credentials&scope={SCOPES}'

📘 Official doc: https://developer.adobe.com/developer-console/docs/guides/authentication/ServerToServerAuthentication/implementation

🟣 Matomo

Auth method:

One simple token: token_auth
Can be passed as:
‣ POST body (recommended)
‣ Query param (refused for tokens created with “Only allow secure requests”)

Example:

curl -X POST "https://matomo.yourdomain.com/index.php" \
  -d "module=API&method=VisitsSummary.get&idSite=1&period=day&date=today&format=JSON&token_auth=your_token"

📘 Official doc: https://developer.matomo.org/api-reference/reporting-api

🔐 Tips & Takeaways

Want to call an analytics API?

‣ First step: secure your auth setup
‣ Never hardcode your keys in public repos
‣ Handle token expiration properly (Google: 1 hour, Adobe: about 24 hours, Matomo: only if you set an expiry date)

Authentication isn’t a blocker.
👉 It’s the entry ticket to reliable, secure data access.

How to Authenticate to Google, Adobe & Matomo APIs

Related reading