google tag manager, under version control

Google Tag Manager publishes to production. Without a pull request.

GTM records every change in its own console — but there is no diff to review, no approval you can wire into your own process, and its built-in review is enterprise-only. So JavaScript reaches every page without the review you would give any other code. Tagora syncs your container to a repository you own, where each change arrives as a pull request, reviewed wherever you already review code.

Check any container →See how it works

No login. Reads only the public container, the same file every visitor already downloads.

  $ tagora container ls
  CONTAINER ID  NAME                  TYPE    ACCOUNT
  ──────────────────────────────────────────────────
  GTM-T4B7HXJ   Storefront — prod  web     Northwind
  GTM-KQ2P8ZR   Storefront — sGTM  server  Northwind

  $ tagora container sync -c GTM-T4B7HXJ -r northwind/tags
  ✓ GTM-T4B7HXJ: opened PR #48
    https://github.com/northwind/tags/pull/48

  # the diff in that PR
  gtm/GTM-T4B7HXJ/tags/17__ga4-purchase.json
  -  "consent": ["analytics_storage"]
  +  "consent": []
  gtm/GTM-T4B7HXJ/tags/23__custom-html-14.json
  +  "html": "<script src="//cdn.partner.example/p.js">"

Re-running updates the same pull request. A run that finds no change opens nothing, so a scheduled sync is silent until something actually moves.

How it works

GTM's API can export a container with its real tag and trigger names — the runtime gtm.js strips them, which is why watching the public file can never produce a diff a human can read. Tagora exports through the API, writes deterministic JSON, and opens a pull request when something changes.

Export to a repo you own. Your container becomes reviewable JSON — tags, triggers and variables, with their names — in your repository, in a path you choose.
Changes arrive as pull requests. A publish in GTM becomes a diff someone can read, approve, or revert, the same way you gate application code.
Least privilege by default. Read-only on GTM. On GitHub we open a PR — we never need merge rights. Automatic merging is opt-in and asks for more, and you can always run it yourself instead.
See unreviewed custom code. Custom HTML and custom templates are real JavaScript on every page. Know when it changes.

What running it looks like

Three commands: connect to each side, then sync. Credentials stay in ~/.tagora on your machine — there is no Tagora server between you, Google and GitHub.

Connect Google, read-only

One scope, tagmanager.readonly. Tagora cannot create, modify, publish or delete anything in Tag Manager. If you have gcloud, no credential registration is needed at all.

  $ gcloud auth application-default login \
      --scopes=https://www.googleapis.com/auth/tagmanager.readonly

  $ tagora status
  Google — reads your GTM containers
  ────────────────────────────────────────
    ✓ connected — 1 account, 2 containers:
      Northwind · account 6012345678 · 2 containers

Connect GitHub, per repository

Two steps, and they do different things: signing in says who you are, installing says which repositories Tagora may touch. It opens a pull request and never needs merge rights.

  $ tagora auth github

    Open:  https://github.com/login/device
    Code:  A1B2-C3D4

  ✓ Connected to GitHub.

  Repositories you can sync (1):
    northwind/tags

Sync, on demand or on a schedule

Nothing is written to disk and no clone is needed — the files are built in memory and committed through GitHub's API, so this runs the same in CI as on a laptop. Read the docs →

  # one repo can hold many containers
  $ tagora container sync -c GTM-T4B7HXJ -r northwind/tags --path gtm

  # only the object types you care about
  $ tagora container sync -c GTM-T4B7HXJ -r northwind/tags \
      --only tags,triggers --no-container-json

  # export to a directory instead, and diff it yourself
  $ tagora container export -c GTM-T4B7HXJ -o ./gtm

Every value above is real output from the CLI. The package is not on npm yet — leave an email and we will tell you once, when it is.

Run it whichever way you trust

Your GTM container is already public — every visitor downloads it. Your GitHub access is not. So the choice of who holds credentials is yours, and the product is the same either way.

GitHub Action. Runs in your own CI. Your tokens never leave your infrastructure. (free, BSL)
Docker. Run it on your own schedule, anywhere you like. (free, BSL)
Managed. We run the sync and add the control plane — monitoring, history, alerting across containers. Credentials are encrypted with keys we manage; bring-your-own-key is on the roadmap. (in development)

What is actually in production containers

Not a survey. Every figure below is measured from published containers, read the same way any visitor's browser reads them.

37,268

containers measured, from a crawl of 175,929 ranked domains

76.3%

ship at least one Custom HTML tag — real JavaScript, on every page, reviewed by nobody downstream

5,773

published versions on the most-republished container we found; the median is 47

Read from public containers only. See the measurements → or check any site yourself →

Recently checked

Containers measured from the public web, newest first.

Loading…

Browse all audited containers →

Want the export when it ships?

The Action, the Docker image and the CLI are free. Leave an email and we will tell you once, when they are ready — or tell us how you would want to use it, which is more useful to us than the email.