Ok found the solution here
Go to your [configured apps](https://admin.google.com/ac/owl/list?tab=configuredApps), choose Add App, and OAuth App Name Or Client ID. Search for Retool and select their listings. When you authenticate again you'll see Retool is no longer blocked, and it will ask for permissions to access your GA services.
So this seems to be a prerequisite to connect GA with retool, you need to first allowlist the retool app, note I am using a Google Workspaces account.