Setup Guide
Hyde & Hare
21 August 2026
0 of 11 done
Prepared for Piers

Build Your Own
Marketing Data Assistant

Right now, to know how the business is doing you log into five different websites. Shopify for orders. Meta for ad spend. Google for search. Klaviyo for email. Triple Whale to try to tie it together. Then you copy numbers into a spreadsheet and hope the maths is right.

We are going to replace all of that with one thing you can just talk to.

You will have an app on your laptop. You type a question in normal English, like "how did last week compare to the same week last year, and where did the growth actually come from?" It goes and gets the real numbers from all five platforms itself, does the analysis, and answers you. No spreadsheet, no logging in, no copy and paste. Everything below is just the plumbing to make that possible.

Two things to know first

It runs on your laptop

Not in the cloud. Your data never sits on anyone else's server. The keys that unlock your accounts live in one protected file on your machine. That is deliberate, and it is the safest version of this.

Day one is read-only

Every key you create is locked to look, don't touch. It can read orders, ad spend and email performance. It cannot spend money, change a product, pause a campaign or send an email. We unlock things later, one at a time, once you know how it behaves.

Before the call

Five jobs, about an hour in total. The first one has a waiting period at Google's end, so please start that one today even if you do nothing else. Tap any step to open it.

1
Apply for the Google Ads developer tokenDo this first
The only step with a queue. Google approves these manually and it can take a few days.
▼
  1. You need a Manager account (also called an MCC) to apply. If you do not have one, create it at ads.google.com/home/tools/manager-accounts
  2. Inside the Manager account go to Tools > Setup > API Center
  3. Fill in the application. When it asks what you are building, say: "Internal reporting tool to read our own campaign performance data. Read-only. Single company, no external users."
  4. Submit
Expect this

You get a token immediately, but it starts on "Test Account" access which does not work on real data. The approval upgrades it to Basic Access. Let Casey know the moment that email lands.

2
Install the two apps~15 min
Claude Desktop is what you will actually use. Homebrew installs the bits that run underneath it.
▼

Claude Desktop. Download from claude.ai/download, install, sign in. That is all for now.

Homebrew. Open the Terminal app (Applications > Utilities, or press Cmd+Space and type "Terminal"). Paste this in and press Enter:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

It will ask for your Mac password, which is normal. When it finishes it may print two lines starting with echo and ask you to run them. Do that. Then paste this:

brew install node git
Good news

That is the only time you need the Terminal. Everything after this happens inside the Claude app.

3
Set up a password vault~5 min
Do this before you generate a single key, so you have somewhere to put them as they appear.
▼

You are about to create five API keys. These are effectively passwords to your business data, so they need to live somewhere proper. Not in Notes, not in an email to yourself.

  1. If you do not have 1Password, sign up at 1password.com
  2. Create a new vault called Hyde & Hare API
  3. Leave it empty. You will fill it in the last step.

If your team already uses Bitwarden, Dashlane or similar, use that instead. The point is a real vault with a master password, not a file.

4
Create a private GitHub repository~5 min
This is the backup, so a dead laptop does not mean starting again. You do not need to know how to use GitHub.
▼
  1. Sign up at github.com if you do not have an account
  2. Click New repository
  3. Name it hyde-and-hare-data
  4. Set it to Private. This matters.
  5. Tick "Add a README file", create it, and send Casey the link
Important

The API keys never go into GitHub. Only the code does. We will configure that on the call so it is impossible to do by accident.

5
Generate the five API keys~30 min
Work through them one at a time. Paste each into 1Password the second it appears, because most are shown once and then hidden forever.
▼

Name each 1Password item clearly, like "Shopify API token" or "Meta system user token". If you close a tab without saving, you have to regenerate that one.

Shopify

Shopify changed this in January 2026, so ignore any older guide that says to use "Develop apps" inside the admin.

  1. Go to dev.shopify.com, sign in with your Shopify account
  2. Create a new app called "Hyde & Hare Reporting"
  3. App URL: http://localhost:3000
  4. Embedded in Shopify admin: OFF
  5. Allowed redirection URL: http://localhost:3000/callback
  6. Preferences URL: leave blank
  7. Tick exactly these scopes and nothing else:
read_ordersread_all_ordersread_productsread_customersread_inventory

Save the Client ID and Client Secret to 1Password.

Why read_all_orders matters

Without it you only get the last 60 days of orders, which kills any year-on-year comparison. There is one more step to turn these into a working token, but it needs a command run on your machine, so we will do that together on the call.

Meta (Facebook and Instagram)

You need to be an admin of the Hyde & Hare Business Manager for this.

  1. At developers.facebook.com click My Apps > Create App. Use case Other, type Business. Link it to your Business Manager.
  2. Go to business.facebook.com/settings, then Users > System Users > Add
  3. Name it "Reporting", role Employee (not Admin)
  4. Click Assign Assets, add your ad account, give it View Performance only
  5. Click Generate New Token, pick the app you just made, and tick only:
ads_readread_insights

Copy the token into 1Password immediately. It is shown once, and it does not expire, which is exactly why we keep it view-only.

Google Ads

Alongside the developer token from step 1, you need two smaller pieces:

  1. At console.cloud.google.com create a project called "HH Reporting"
  2. Search for and enable the Google Ads API
  3. Go to APIs & Services > Credentials > Create Credentials > OAuth client ID
  4. Application type: Desktop app
  5. Save the Client ID and Client Secret to 1Password

Also note your Google Ads Customer ID, the 10-digit number at the top right of the account, formatted like 123-456-7890. A third piece (a refresh token) gets generated on the call.

Klaviyo

  1. Settings > API Keys > Create Private API Key, name it "Reporting"
  2. Choose Custom Scopes rather than full access
  3. Set every single scope to Read. Leave nothing on Write.
  4. Save to 1Password. Shown once.

Triple Whale

  1. Settings > API Keys, create a new key named "Reporting"
  2. Save it to 1Password

If you cannot find that menu it may depend on your plan tier. Flag it and we will sort it on the call.

What we do on the call

So you know exactly what is left. Budget about 90 minutes.

Turn your Shopify Client ID and Secret into a working token. One command, two minutes.
Generate the Google Ads refresh token. Same idea.
Build the connector. This is the piece of software that lets the assistant reach all five platforms. It is small, around 200 lines, and I will walk you through what each part does so it is not a black box.
Put the keys into their protected file and lock down the permissions on it.
Connect the GitHub backup, with the keys excluded so they can never be pushed by accident.
Run your first real question end to end.
Walk through five or six questions worth asking, so you have somewhere to start.

The security rules

Short list. These are the ones that actually matter.

01
Every key is read-only

You are not one typo away from spending money or deleting a product. If a key can only read, the worst case of a mistake is a wrong number on a screen.

02
Keys live in exactly two places

1Password, and one protected file on your laptop. We will set that file so only your user account can open it. Nowhere else. Not in an email, not in Slack, not in a document.

03
Never paste a key into a chat window

Including into Claude itself. It does not need you to, it reads them from the file automatically. If you find yourself about to paste something starting with shpat_, sk_ or EAA, stop.

04
The key file never goes to GitHub

We configure this on the call so it is blocked by the tooling rather than by you remembering.

05
If a laptop is lost, rotate

Every key here can be deleted and regenerated in about two minutes from the platform that issued it. Deleting instantly kills access. Worth knowing the emergency button exists and is easy to press.

06
Review every six months

Delete anything you are not using. Ten minutes, and it is the highest-value security habit there is.

Final checklist

Tick these off as you go. Your progress saves automatically in this browser.

If something goes wrong

Do not fight it. Screenshot the error and send it over, and we will do that one together. Getting four of the five done is a completely fine outcome for tomorrow.

Kova Commercekovacommerce.aiConfidential