How to Set Up Google Business Profile

Step 1: Create a Google Cloud Project

1. Go to Google Cloud Console and sign in with your agency Google account.
2. Click the project dropdown at the top and select New Project.
3. Name it something like FlameGrower GBP and click Create.
4. Wait a few seconds for the project to be created, then select it from the dropdown.

Step 2: Enable the APIs

FlameGrower uses 3 separate Google APIs — all three must be enabled:

1. From the left sidebar, go to APIs & Services → Library.
2. Search for and enable each of these:
   • My Business Account Management API
   • My Business Business Information API
   • Business Profile API (may also appear as "Google My Business API")
3. Confirm all three show as Enabled under APIs & Services → Enabled APIs and services.

Step 3: Request GBP API Access (Critical!)

1. Go to Google's GBP API Access Request page.
2. Fill out the request form. In the "Use case" section, explain:
   • You're building a reputation management platform (FlameGrower Reviews)
   • You need to read reviews and manage locations for your agency's business clients
   • Each client authorizes their own account via OAuth
3. Submit and wait for Google's approval email (typically 1–3 business days).
4. After approval, your quotas will show non-zero values, and API calls will work.

Step 4: Configure the OAuth Consent Screen

1. Go to APIs & Services → OAuth consent screen.
2. Choose External user type and click Create.
3. Fill in:
   • App name: FlameGrower Reviews
   • User support email: Your agency email
   • Developer contact: Your agency email
4. Click Save and Continue. You can skip the Scopes page for now — nothing breaks while the app is in Testing. On Test Users, add your own email and click Save and Continue.
5. Note for later: skipping Scopes only works in Testing. Before you can submit for verification (Step 8), https://www.googleapis.com/auth/business.manage must be declared on that Scopes page — Google reviews what you declare there, and an app requesting a scope it never declared will not pass.

Step 5: Create OAuth Credentials

1. Go to APIs & Services → Credentials.
2. Click + Create Credentials → OAuth client ID.
3. Choose Web application as the application type.
4. Give it a name like "FlameGrower Web".
5. Under Authorized redirect URIs, click + Add URI and enter:
   https://reviews.flamegrower.com/oauth/google/callback
6. Click Create.
7. Copy the Client ID and Client Secret — you'll paste them below on the Integrations page.

Step 6: Enter Credentials

Back on the Integrations page, paste the Client ID and Client Secret into the Google Business Profile section and click Save Settings.

Step 7: Increase API Quotas (Critical!)

1. Go to APIs & Services → Quotas.
2. In the filter, search for "Requests per minute".
3. Find and increase both of these to at least 30 RPM:
   • My Business Account Management API — Requests per minute
   • My Business Business Information API — Requests per minute
4. Click each one, choose Edit (pencil icon), set the new limit, and submit.
5. Quota increases usually take effect within a few minutes.

Step 8: Publish to Production (Critical!)

To confirm Gate A is not your problem: go to APIs & Services → Enabled APIs and services → Business Profile API → Quotas. 0 QPM means not approved — go back to Step 3. 300 QPM means approved, and any 403 you're seeing is Gate B.

1. This app requests exactly one scope, https://www.googleapis.com/auth/business.manage, and no identity scopes. On the OAuth consent screen's Scopes page, confirm Google labels it Sensitive — do not assume; check it. Sensitive scopes require verification before the app can be used by anyone other than the test users you've added. If it ever shows Restricted instead of Sensitive, that additionally requires an annual third-party CASA security assessment — real cost, real lead time — so stop and escalate rather than proceeding.
2. Before submitting for verification, have all of this ready — Google will ask for every item:
   • A live privacy policy URL — /legal/privacy (already carries Google's required Limited Use disclosure)
   • A live terms of service URL — /legal/terms
   • Search Console domain-ownership verification for every domain registered on the consent screen
   • App name, support email, and logo that exactly match what a reviewer will see on the consent screen
   • A short demo video walking through the OAuth consent flow end to end — Google routinely requires one
3. Go to APIs & Services → OAuth consent screen, click Publish App, then submit for verification when Google prompts for it.
4. Expect this to take weeks, not days, and to involve back-and-forth with a Google reviewer. Start it well before a client needs to connect — not the week they sign up.