Google API Access Setup Kit — Multiverbe

Owner founder: Gregorio Deadline originale: 2026-05-17 (scaduto +1g · slip accettato) Sblocca: Reach satellite C1b (Google Business Profile API) + E1 (Google Search Console API) Tempo stimato: 60-90 min totali in una sessione singola Critical path: GBP API review è 60gg dalla creazione GBP profile → l'orologio parte ORA

🟢 STATO 2026-05-22 (aggiornamento post-v49)

✅ Step 1 GCP project: multiverbe-production (#297810897382) creato. ⚠️ duplicato vuoto astute-rig-497020-s8 da una sessione precedente — eliminare solo a ID confermato.
✅ Step 3 OAuth consent screen: External/Testing, app "Multiverbe", domini multiverbe.com + multiverbe.app, privacy/terms/home su multiverbe.com, support/dev = metaverbe@gmail.com.
✅ Step 4 OAuth client: "Multiverbe Web Backend", redirect apex https://multiverbe.app/api/reach/google-oauth-callback (+ alias localhost). Env vars deployate in Vercel.
✅ Step 6 GBP profile: "Multiverbe" creato + VERIFICATO (clock 60gg avviato). Account metaverbe@gmail.com.
🟢 Step 7 Search Console: multiverbe.app VERIFICATO. multiverbe.com — record TXT corretto il 2026-05-31 (era salvato con Nome @ → finiva su @.multiverbe.com; ora all'apex multiverbe.com) e LIVE su ns1/ns2. ✅ VERIFICATO 2026-05-31 (metodo DNS TXT) — entrambi i domini ora verificati in Search Console. Vedi search-console-dns-records-2026-05-22.md.
🟢 Step 5 GBP API request: artefatto pronto → gbp-api-access-request-2026-05-22.md. Prerequisito 60gg GIÀ SODDISFATTO via profilo Metaverbe (verificato 17 feb 2026, ≈94gg, stesso account) — non serve attendere fine luglio. Submit dopo Search Console verificata + checklist verde.
⏳ Resta in OAuth Testing — NON cliccare "Pubblica app". Logo consent screen = caricamento manuale founder.
⏳ Loris test user: serve email ACCOUNT GOOGLE (Apple ID rifiutato).

Pre-flight check (5 min)

Prima di iniziare verifica:

[ ] Privacy Policy live: https://multiverbe.com/privacy ✅ (Iubenda doc 92115618)
[ ] Terms of Service live: https://multiverbe.com/terms ✅ (placeholder pre-launch ma accessibile)
[ ] Dominio multiverbe.com di tua proprietà (founder = sì)
[ ] Logo Multiverbe disponibile come PNG ≥120×120 quadrato (vedi frontend/multiverbe-app/public/multiverbe-mark.png)

STEP 1 · Google Cloud project (10 min)

Vai: https://console.cloud.google.com/
Project selector top-bar → New Project
Compila:
- Project name: Multiverbe Production
- Project ID (auto): lascia auto-generated o multiverbe-prod
- Organization: nessuna (account personal) o tua org se ne hai
- Location: No organization
Create → attendi creazione ~30 sec
Salva il Project ID (lo userai per env vars: GOOGLE_CLOUD_PROJECT_ID)

STEP 2 · Enable required APIs (5 min)

Nel project appena creato:

Sidebar → APIs & Services → Library
Cerca e abilita queste 3 API (click → Enable):
- Google Business Profile API (per C1b · NAP sync clienti)
- My Business Account Management API (necessaria per GBP)
- Google Search Console API (per E1 · query analytics)

⚠️ La Business Profile API richiede una richiesta di accesso separata (Step 5). Le altre si abilitano subito.

Sidebar → APIs & Services → OAuth consent screen

Page 1 · Audience

User Type: External (lascia Internal se hai Google Workspace org, ma probabilmente NO)
Create

Page 2 · App Information

Copia-incolla questi valori esatti:

App name:                Multiverbe
User support email:      metaverbe@gmail.com   # NB: no Google Workspace → support email @multiverbe.com non disponibile ora; metaverbe@gmail.com OK in Testing
App logo:                Upload "multiverbe-mark.png" (512×512, sfondo trasparente) — caricamento MANUALE founder (file_upload rifiuta path progetto)
Application home page:   https://multiverbe.com
Application privacy policy: https://multiverbe.com/privacy
Application terms of service: https://multiverbe.com/terms
Authorized domains:      multiverbe.com
                         multiverbe.app
Developer contact:       metaverbe@gmail.com

⚠️ Authorized domains — aggiungi entrambi. Vercel ha sia multiverbe.com (landing) sia multiverbe.app (sites runtime).

Page 3 · Scopes

Skip per ora — vediamo solo i base scopes. Click "Save and Continue".

Quando arriveranno le API GBP+GSC approved (Step 5), tornerai qui per aggiungere:

https://www.googleapis.com/auth/business.manage (GBP)
https://www.googleapis.com/auth/webmasters.readonly (GSC)

Page 4 · Test users

Aggiungi:

metaverbe@gmail.com          # account proprietario · test user principale ✅
# loris.beraud17.7@icloud.com → RIFIUTATO da Google (Apple ID NON è un account Google).
#   Loris deve fornire una email ACCOUNT GOOGLE → poi aggiungerla qui come test user.

Page 5 · Summary → Back to Dashboard

Verify: "Publishing status" = Testing. Va bene così pre-launch (con test users) — non serve "In production" finché non hai >100 utenti reali.

STEP 4 · OAuth 2.0 Client Credentials (10 min)

Sidebar → APIs & Services → Credentials → + Create Credentials → OAuth client ID

Application type:    Web application
Name:                Multiverbe Web Backend (server-to-server)
Authorized JavaScript origins:
                     https://multiverbe.app
                     http://localhost:5173
                     http://localhost:3000
Authorized redirect URIs:
                     https://multiverbe.app/api/reach/google-oauth-callback
                     http://localhost:5173/api/reach/google-oauth-callback
# NB: solo apex multiverbe.app. app.multiverbe.com / app.multiverbe.app fanno 308 -> apex,
# e Google NON segue redirect sul callback OAuth: il redirect_uri deve essere l'apex esatto.

Create → si apre modal con:

Client ID: copia
Client secret: copia

Salva in Vercel env vars project multiverbe-app Production scope:

GOOGLE_OAUTH_CLIENT_ID=<client-id-copiato>
GOOGLE_OAUTH_CLIENT_SECRET=<client-secret-copiato>
GOOGLE_OAUTH_REDIRECT_URI=https://multiverbe.app/api/reach/google-oauth-callback

STEP 5 · GBP API Access Request (20 min + 2-6 settimane review)

⚠️ CRITICAL PATH: questo step ha lead time settimanale e va fatto SUBITO.

Vai: https://support.google.com/business/contact/api_default

Compila il form:

Your name:               Gregorio Ciurleo
Email:                   metaverbe@gmail.com   # inbox account garantita (alt: gregorio@multiverbe.com via catch-all)
Company name:            Multiverbe
GCP Project ID:          <quello del Step 1>
Country:                 Switzerland
Number of locations you'll manage:  100-1000 (stima inizio · 1 location per cliente PMI)
Type of business:        SaaS / Business Software
Website:                 https://multiverbe.com

Use case description (copy-paste questo testo verbatim):

Multiverbe is a Swiss B2B SaaS platform serving small and medium businesses
(restaurants, hairdressers, gyms, hotels) in Switzerland (primarily Ticino and
Grigioni). We help our customers manage their Google Business Profile listing
NAP consistency (Name/Address/Phone), syncing their info from our centralized
dashboard to GBP and pulling back reviews/insights into our analytics.

Use of API:
1. Authenticated user OAuth flow: each SMB customer connects their own GBP
   account to their Multiverbe workspace.
2. Read GBP location info (name, address, phone, hours, categories).
3. Write back updates when customer edits NAP fields in Multiverbe dashboard.
4. Read reviews + insights for the customer's locations.
5. NO bulk operations across locations · NO data resale · NO scraping.

Data handling:
- Per-customer OAuth tokens stored encrypted in Supabase EU (Frankfurt).
- RLS multi-tenant isolation (workspace_id).
- GDPR + Swiss revFADP compliant.
- Privacy policy: https://multiverbe.com/privacy
- Sub-processor list: https://multiverbe.com/privacy (includes Google as data processor for GBP API consumers).

OAuth consent screen URL:
https://console.cloud.google.com/apis/credentials/consent?project=<your-project-id>

Scopes requested:
https://www.googleapis.com/auth/business.manage

Demo/screenshots:
Multiverbe dashboard NAP sync feature mockup attached / available on request.
Public landing page: https://multiverbe.com
Product video: <da preparare se richiesto da reviewer · 2 min max>

Submit → riceverai email da googleapis-prod@gmail.com o simili entro 5-15 giorni lavorativi.

Anti-rifiuto checklist (Google reviewer pignoli — controlla TUTTO prima di submit):

[ ] Consent screen completo (logo, privacy, terms, support email) — verifica andando su https://console.cloud.google.com/apis/credentials/consent
[ ] Privacy policy COPRE esplicitamente trattamento dati utenti Google (✅ Iubenda 92115618 standard)
[ ] Scope minimum (solo business.manage, NON full)
[ ] Domini authorized (multiverbe.com + multiverbe.app) verificati in Search Console
[ ] No mismatch nome/dominio (app name = "Multiverbe", domain = multiverbe.com — coerente)

STEP 6 · Google Business Profile aziendale (10 min · clock 60gg parte ORA)

Anche se l'API non è ancora approved, crea ORA il GBP aziendale perché il prerequisito API è "profilo verificato e posseduto da 60+ giorni".

Vai: https://www.google.com/business/

Business name:           Multiverbe
Business category:       Software company (primary)
                         Business management software (secondary)
                         Marketing agency (terziaria)
Location:                Yes, deliver to customers (servizio digitale, no negozio fisico)
Service areas:           Switzerland (Lugano, Ticino, Grigioni, full CH)
                         Italy (mercato secondario)
Contact info:
  Phone:                 (il tuo CH mobile · verrà verificato via SMS)
  Website:               https://multiverbe.com
Address (privato · NON visualizzato al pubblico):
  Monteggio, Ticino, Svizzera, CH-6998
Verification method:     Postcard (5-10 giorni) o SMS se disponibile

Verify ASAP. Il clock 60gg parte dal momento della creazione, NON dalla verifica.

STEP 7 · Search Console verification (10 min · per GSC API)

Mentre aspetti GBP API:

Vai: https://search.google.com/search-console
Add property → Domain type (verifica DNS TXT)
Aggiungi entrambi:
- multiverbe.com
- multiverbe.app
Google ti dà un TXT record google-site-verification=... per ognuno
Vai Register.it → DNS multiverbe.com → aggiungi TXT record
Stessa cosa per multiverbe.app (gestito da Vercel DNS se hai cambiato nameservers, altrimenti Register.it)
Aspetta ~15 min propagation → Verify in Search Console
Submit sitemap: https://multiverbe.com/sitemap.xml (se esiste — verificare con Claude)
Indexnow ping: già implementato in sites-runtime per i siti clienti

STEP 8 · Vercel env vars finali (3 min)

Project multiverbe-app → Settings → Environment Variables → Production:

GOOGLE_OAUTH_CLIENT_ID=<from Step 4>
GOOGLE_OAUTH_CLIENT_SECRET=<from Step 4>
GOOGLE_OAUTH_REDIRECT_URI=https://multiverbe.app/api/reach/google-oauth-callback
GOOGLE_CLOUD_PROJECT_ID=<from Step 1>

# Quando GBP API approved (Step 5 review done):
GOOGLE_BUSINESS_PROFILE_ENABLED=true

# Quando GSC verified (Step 7 done):
GOOGLE_SEARCH_CONSOLE_ENABLED=true

Trigger redeploy production dopo ogni env var add (sticky).

STEP 9 · Test end-to-end (15 min · dopo GBP API approved)

Quando ricevi email "Your application is approved":

Login dashboard multiverbe.app come founder
Vai → Pianeta Web → satellite Reviews (NapPage)
Click "Connect Google Business Profile"
OAuth flow:
- Redirect a accounts.google.com
- Consent screen Multiverbe (con logo + privacy)
- Authorize → redirect back a /api/reach/google-oauth-callback
Verify backend: oauth_connections table riga con provider='google' scope='business.manage'
NAP fields sincronizzati: edit indirizzo in Multiverbe → cambia su Google Maps entro 2-5 min

Tempi attesi

Step	Tempo founder	Lead time esterno
1 GCP project	10 min	–
2 Enable APIs	5 min	–
3 OAuth consent	15 min	–
4 OAuth credentials	10 min	–
5 GBP API request	20 min	2-6 settimane review
6 GBP profile create	10 min	60gg clock fino API eligibility
7 Search Console	10 min	15 min DNS propagation
8 Vercel env	3 min	–
9 E2E test	15 min	–
TOTALE	~90 min sessione	review window

Critical insight: Step 5 + Step 6 hanno lead time esterno (Google review 2-6 settimane, GBP 60gg). Fai SUBITO anche se tutto il resto è pronto solo dopo. La nostra hard gate 10 Giu non dipende da Google API approval (Reach satellite C1b è "nice-to-have post-MVP" per Mossa 5).

Risorse autoritative

Google Business Profile API docs: https://developers.google.com/my-business
OAuth 2.0 for Web Server Applications: https://developers.google.com/identity/protocols/oauth2/web-server
Search Console API docs: https://developers.google.com/webmaster-tools
Multiverbe Reach spec: Multiverbe-Business/ops/pianeta-web-quality-stack-spec.md § Stream 5

Last update: 2026-05-18 · Multiverbe code repo frontend/multiverbe-app/src/lib/reach/adapters/ ha gli scaffold OAuth pronti — attendono solo le env vars + API approval per accendersi.