Integrations

Most integrations use OAuth, the same secure standard you see when an app asks to "Continue with Google". You click Connect, authorize on the provider's own screen, and CrunchJunkie receives a scoped, revocable access token — never your password. A few self-hosted analytics tools (Matomo and Piwik PRO) work a little differently: instead of an OAuth redirect, you paste your own instance URL plus a read-only API token. Either way, the credential is encrypted at rest, grants read-only access, and can be revoked from the provider at any time. After connecting, you choose which accounts, properties, or sites to import. The first sync runs immediately; from then on, data refreshes automatically once a day. The Integrations page shows the health of every connection, so you always know your data is current.

For Google Ads, click Connect on the Google Ads card and authorize with the Google account that has access to the relevant ad accounts. If you manage clients through an MCC, you'll be able to select individual accounts under it — import only the ones you report on. GA4 works the same way: authorize with Google and pick the specific properties you need. Both integrations require that the Google user you authorize with has at least read access to the accounts or properties. If an account doesn't appear in the selection list, it's almost always a permissions issue on the Google side rather than a CrunchJunkie one.

Meta Ads connects through Facebook Login. Authorize with a user who has a role on the relevant Business Manager and ad accounts, then select the ad accounts to import. Because Meta periodically requires re-authorization, CrunchJunkie watches token validity and warns you before a connection lapses. LinkedIn Ads follows the same OAuth flow. Authorize with an account that has access to the Campaign Manager ad accounts you report on, and select them during setup. As with every integration, you grant read access only — CrunchJunkie never makes changes to your campaigns.

Microsoft Ads (Bing), TikTok Ads, and Google Search Console each connect with a single OAuth click on their card in the Integrations page. For Microsoft Ads and TikTok, authorize with a user who has access to the ad accounts and choose which to import. Search Console connects via Google and lets you pick the verified properties whose organic search data you want in reports. All three refresh daily alongside your other sources, and all three appear in the same connection-health view so you can manage your entire stack from one screen.

Amazon Ads connects over OAuth (Login with Amazon) and pulls read-only Sponsored Products reporting. Because Amazon's API is region-split, you pick the advertiser's marketplace region when you connect. To connect: 1. Make sure the client you're reporting for exists under Clients (you'll assign the connection to it). 2. Open Data → Integrations and click Connect on the Amazon Ads card. 3. Choose the advertiser's marketplace region — Europe (EU), North America (NA), or Far East (FE). This must match where the ad account is based. 4. Sign in with Login with Amazon using an Amazon user that has access to the advertiser's account, and approve the read-only access. 5. Pick the exact ad profile (advertiser account) to import, and assign it to the client. The first sync starts immediately; data then refreshes daily. To report on a client's account, the client either adds your Amazon user (with Viewer/Reporting access) in their Amazon Ads console, or authorizes the connection themselves during step 4. Available data covers Sponsored Products across campaigns, ad groups, keywords/targeting, customer search terms, and advertised vs purchased products — with metrics including Impressions, Clicks, Spend, CTR, Avg. CPC, CPM, Orders, Sales, Units, ACOS and ROAS. Amazon's reports are generated asynchronously, so the first load of a breakdown can take a few moments. Not yet included: Sponsored Brands, Sponsored Display, and Amazon DSP (streaming/OTT video, including Twitch) — DSP requires a separate Amazon approval beyond standard API access. And one note if you ever see a "bad scope" error on connect: that means the Login-with-Amazon profile isn't associated with approved Amazon Ads API access yet — it's an Amazon account-setup state, not a CrunchJunkie issue.

Reddit Ads connects over OAuth and pulls read-only campaign reporting. Click Connect on the Reddit Ads card in Data → Integrations, authorize with a Reddit user who has access to the advertiser's Ads account, then pick the ad account to import and assign it to a client. The credential is stored encrypted, grants read-only access, and can be revoked from Reddit at any time; data refreshes daily like every other source. Available metrics include Impressions, Clicks, Spend, CTR, Avg. CPC, eCPM, Reach, Frequency, Conversions, Conversion rate, ROAS and Conversion value, plus Reddit-specific engagement — video views and quartile completion (3s, 25/50/75/100% and completion rate) and comment upvotes/downvotes — broken down over time or by campaign. When you draft a report with AI, a connected Reddit account contributes a key-metrics scorecard and a spend-and-conversions-over-time chart automatically, and blends into cross-channel comparisons alongside your other paid sources.

Matomo doesn't use OAuth — every Matomo instance is self-hosted or on Matomo Cloud, so you connect it with your instance URL and a read-only API token (Matomo calls this a "token_auth"). It works with both Matomo Cloud and self-hosted Matomo 4 and 5. First, create the token in Matomo. Sign in as a user who has at least View access to the site you want to report on (using a View-only user keeps the token strictly read-only), then go to the gear icon (Administration) → Personal → Security → Auth tokens → "Create new token". Confirm your password, give the token a description like "CrunchJunkie", and create it. Matomo shows the token only once, so copy it straight away. You can leave "Only allow secure requests" enabled — CrunchJunkie sends the token in the request body, which satisfies that setting. Then connect it in CrunchJunkie. Open Data → Integrations and click Connect on the Matomo card. Paste your instance URL — the address before /index.php, for example https://yourcompany.matomo.cloud — and the token_auth, then click Connect. CrunchJunkie verifies the credentials immediately and lists the sites the token can see. Pick the site you want and assign it to a client. The token is stored encrypted, access is read-only, and data refreshes daily like every other source. To rotate or revoke access later, delete the token in Matomo (Administration → Personal → Security → Auth tokens) and reconnect with a new one. Available metrics include Visits, Unique visitors (approx.), Actions, Actions / visit, Bounce rate, Conversions, Conversion rate, and Revenue — over time or broken down by channel, source, campaign, country/region/city, device, browser, OS, top/entry/exit pages, and goals. One note on accuracy: "Unique visitors (approx.)" is labelled that way on purpose. Matomo can't return a true unique-visitor count across a multi-day range, so for ranges longer than a day CrunchJunkie sums each day's uniques — which slightly overcounts anyone who visited on more than one day. Single-day figures are exact, and every other metric (visits, actions, bounce rate, conversions, revenue) is exact across any range.

Piwik PRO also connects with credentials rather than OAuth, using its API client-credentials grant. It works with Piwik PRO Cloud and on-premises instances. First, create an API client in Piwik PRO. As an admin, open Settings → API (Administration) and create a new API credential — Piwik PRO issues a Client ID and Client Secret. These act like a scoped, revocable key for read access to your analytics data. Then connect it in CrunchJunkie. Open Data → Integrations and click Connect on the Piwik PRO card. Paste your instance URL — your Piwik PRO address, for example https://yourorg.piwik.pro — together with the Client ID and Client Secret, then click Connect. CrunchJunkie authenticates immediately, lists the apps (websites) the credential can access, and you pick one and assign it to a client. Credentials are stored encrypted; we mint a short-lived token per request, so nothing long-lived is kept. Available metrics include Sessions, Visitors, Page views, Unique page views, Pages / session, Bounce rate, Goal conversions and Conversion rate — over time or broken down by channel, source, source/medium, campaign, keyword, country/region/city, device, browser, OS and top/entry/exit pages. Reports respect Piwik PRO's "scope" model: session-level breakdowns (channels, geo, devices) and page-level breakdowns (top pages) each use the metrics that belong to that scope, so figures stay consistent. Note Piwik PRO data has roughly a two-hour processing delay, so the current day is usually still filling in.

The Integrations page also lists platforms we're building next, shown as "Coming soon" so you can see where the roadmap is headed: Pinterest Ads, Snapchat Ads, X (Twitter) Ads, Shopify, Klaviyo, HubSpot, Mailchimp, Criteo, Taboola and Outbrain. These are placeholders that capture demand — they are not live connectors yet, so you can't connect them or pull data from them today, and they don't appear in Draft with AI. If one of these is important to your reporting, let us know and it helps us prioritise. We'll announce each on the changelog as it ships.

CrunchJunkie watches your connections so you don't have to. When something needs your input, it surfaces in the Needs attention area on the Integrations page — and it appears there before a report goes out with a gap, not after a client spots one. Two kinds of alert show up here. The first is a reconnect prompt: when a provider expires or revokes a token (often after a password change, a removed permission, or Meta's periodic re-authorization), the affected integration is flagged with a Reconnect banner. One click takes you back through OAuth to restore it, and the daily sync resumes. The second is a bring-your-own-AI-key failure: if you run AI Visibility on your own provider keys and a key stops working — expired, out of quota, or revoked at the provider — that failure is raised in Needs attention too, so a silent scan failure never goes unnoticed. Clear the alert by reconnecting the source or updating the key, and the flag disappears on the next successful sync or scan.

Most issues come down to one of three causes. First, expired or revoked tokens: if a provider invalidates a token (often after a password change or a permissions update on their side), you'll see a "Reconnect" banner — click it and re-authorize to restore the connection. Second, missing permissions: if an account or property doesn't show up during setup, confirm the user you authorized with has at least read access to it on the provider's platform. Third, a stale sync: if numbers look out of date, check the last-sync time on the Integrations page; you can trigger a manual refresh rather than waiting for the daily cycle. If a connection still won't behave after reconnecting and confirming permissions, contact support at hello@crunchjunkie.io with the workspace name and the affected integration, and a real person will help you sort it out.