Vibe coding web analytics: audit GA4, GTM and BigQuery with AI

Analytics audits keep bringing us back to the same questions. How long does GA4 retain data? Is a payment gateway taking credit for an order? And what happened to the parameter that exists in the RAW export but is missing from the report?

Codex or Claude Code can now help investigate much of this. Through APIs, they can read GA4 settings, the published GTM container and BigQuery data. Give them a good checklist and they can work through the audit, following up on connections as they go.

I've put together a repository with checklists and helper scripts. It also includes AGENTS.md and CLAUDE.md with rules for both agents. The output is a report with findings and recommended fixes. Applying those fixes is a job for another day.

In this guide: What you need · Google access · Running the audit · What you get

What you need

• Codex or Claude Code, installed and signed in. Their official guides cover installation.
• Python 3.11+ and the Google Cloud CLI.
• Access to one GA4 property and one web GTM container. BigQuery is optional.

Download the repository from GitHub using Code → Download ZIP, extract it and open it in your agent. On macOS, run these commands from the repository folder:

python3 -m venv .venv
.venv/bin/python -m pip install -r requirements.txt

On Windows, use PowerShell:

py -3 -m venv .venv
.venv\Scripts\python.exe -m pip install -r requirements.txt

This prepares the Python environment and the libraries the scripts need. We'll use gcloud to sign in shortly. BigQuery itself doesn't require it: queries can run directly through the API.

Google access

This is where most of the setup work happens. Signing in to Claude or Codex doesn't give the agent access to your Google accounts.

1. In the Google Cloud Console, select or create a project for API access. It can be a different project from the one holding your GA4 export.
2. Enable the Google Analytics Admin API, Google Analytics Data API and Tag Manager API. For BigQuery, add the BigQuery API; for scheduled queries and Dataform, also enable the BigQuery Data Transfer API and Dataform API.
3. In Google Auth Platform, configure the application and its audience. If it's an external application in Testing mode, add your Google account as a test user.
4. Create an OAuth client of type Desktop app and download its JSON file. Store it outside the repository.
5. Replace the JSON file path in the command below and run it. A browser will open: choose the account with access to the website's analytics and approve the permissions. The command also works in PowerShell.

gcloud auth application-default login --client-id-file="PATH_TO_FILE.json" --scopes="https://www.googleapis.com/auth/analytics.readonly,https://www.googleapis.com/auth/analytics.edit,https://www.googleapis.com/auth/tagmanager.edit.containers,https://www.googleapis.com/auth/cloud-platform"

Use application-default login; regular gcloud auth login isn't enough. This command replaces your existing local ADC credentials. With an external application in Testing mode, expect to sign in again after seven days. See Google's documentation for details.

The account also needs permissions in each service: Editor in GA4, Edit without Publish in GTM, and Data Editor on the selected BigQuery dataset plus Job User on the project used to run queries. Authorizing the application doesn't grant these roles. We're preparing access for later work too, but this audit's instructions allow only reading and recommending changes.

Running the audit

Open the repository folder in Codex or Claude Code. Give the agent the names or IDs of your property, GTM container and any Cloud project involved. Then ask it:

Read AGENTS.md or CLAUDE.md and the shared audit rules.
Prepare config.json for the agreed property, its web streams,
the published GTM container and the BigQuery project, if present.
Check access and work through every applicable checklist item.
Investigate connections independently and recommend fixes, but change nothing.
Start BigQuery with one day; respect the shared data and cost limits.
Save results in a new runs/ folder: report, check status and parameter CSVs.
Distinguish findings, hypotheses and anything you couldn't verify.

The agent doesn't have to stick to the supplied scripts. It can write its own SQL, inspect query history or trace where a parameter gets renamed. That's what it's there for.

To avoid scanning terabytes unnecessarily, the audit starts with one completed day of RAW export data and uses no more than seven days. The default budget is 10 GiB per query and 50 GiB for the entire audit, including the agent's own queries. SQL history is checked for the last 30 days.

What you get

The report describes what the agent found, the evidence behind it and the changes it recommends. It also states where access or evidence was missing.

Two illustrative examples:

• A payment gateway appears as a source of orders. The agent reviews the top 20 session sources for sessions with purchase. If it finds GoPay, for example, it determines its share and flags a likely unwanted-referral issue. The actual setting still needs to be verified.
• A parameter gets lost during processing. product_id arrives as a number in some cases and text in others. The SQL reads only the numeric value, returning NULL instead of an ID for some products. The agent locates the relevant SQL and recommends a consistent type: usually a string for IDs, or an appropriate numeric type for a quantity.

If you have a RAW export in BigQuery and access and budget allow it to be checked, you'll also get parameters.csv: parameters and user properties, their data types, missing or placeholder values, and the agent's estimate of their importance. There's room for your own assessment alongside it. parameter_usage.csv shows the usage traced in SQL. Some parameters are deliberately unused; that alone isn't a problem.

The checklist also recommends the highest available data retention and enabling Google Signals if doing so doesn't make important reports less useful. Neither replaces a properly configured data collection setup.

The audit covers web GA4, published GTM and optional BigQuery. It doesn't cover mobile apps, sGTM or workspaces with unpublished changes. APIs also can't tell you everything that actually happens in the browser.

As a final step, check your website for free with AnalyticsProof. This checks the browser side of your tracking: the cookie banner, Consent Mode and the behavior of detected tracking tools.