Google Analyzer

In Google Cloud, open or create a project. Skip any free-trial or billing offer. This app does not need a paid Cloud plan.
Enable the Admin SDK API on that project.
Open APIs & Services, then OAuth consent screen. Name the app. If the account is in your Workspace, choose Internal.
Create an OAuth client ID of type Web application. Under Authorized redirect URIs add exactly http://127.0.0.1:8775/oauth/callback. Use 127.0.0.1, not localhost.
Copy the client id and client secret into the fields above and click Save client. You can paste the downloaded client JSON into either box.
In the Admin console, go to Security, Access and data control, API controls, then Manage app access. Click Configure new app, find the app by its name or client id, and set it to Trusted for the org. Limited is not enough for audit logs.
Come back here and click Sign in. Choose a Workspace admin who can read reports.

Google connection