Follow the 302 on each google.com/goto token, and do it only for the citations you actually need. Across 57 AI Overview citations pulled through Scavio's POST /api/v2/google this morning, not one link field was a usable URL: 54 were opaque google.com/goto tokens and 3 were truncated fragments. The organic results in the same responses were almost untouched. If your pipeline broke this week, it broke in the citation layer, not the SERP.
Google confirmed the goto passthrough rollout on 27 August 2026, having tested it since July. The public framing was about abuse prevention. The reporting that followed was mostly about SERP scrapers dying. On our data that reporting has the target wrong.
What we ran
Twelve queries, deliberately mixed: commercial intent (best crm for small business, best project management software), local (plumber near me austin, commercial real estate broker chicago), technical (python async tutorial, instagram api documentation), retail (nike running shoes), and a couple aimed at our own market (serp api pricing, how to scrape google search results). One run each, gl=us, hl=en, no_cache=true, on 28 August 2026. Twelve credits.
Seven of the twelve returned an AI Overview. Five did not. That split turned out to be the finding.
The citation layer is gone, the SERP is fine
Across the seven queries that produced an AI Overview, ai_overview.references[] held 57 citations. Zero of them carried a usable URL.
- 54 were
google.com/gototokens, around 200 characters, of the shapehttps://www.google.com/goto?url=CAESWQHrOzAV3I3-LKGoNnYCl84611JOJ5jGH51E.... No domain, no path, nothing parseable. - 3 were truncated fragments. More on those below, because they are ours.
Meanwhile the organic results sitting underneath those same AI Overviews were nearly clean. Out of 111 organic results across all twelve queries, 6 carried a goto token, or 5.4%. The other 105 were ordinary destination URLs that any existing parser would handle without noticing anything had changed.
The 6 were not scattered. Every one of them sat at position 1 or 2, one per query, on six of the seven queries that had an AI Overview. The five queries with no AI Overview returned 44 organic results and not a single goto token anywhere in the response.
We are not going to claim causation from twelve queries. But the separation is total in this sample, and it suggests the rollout is currently scoped to result sets Google is treating as AI surfaces rather than applied blanket-wide. If that holds, the blast radius depends entirely on what your queries look like. A local-services pipeline may not have noticed a thing. An AEO tracker lost everything.
The obvious workaround does not work
The natural reflex on seeing a tokenised link is to reach for the neighbouring field. Our ai_overview.references[] objects carry four keys, and the other three look promising:
{
"title": "Best and inexpensive CRM for small business - Reddit",
"link": "https://www.google.com/goto?url=CAESfQHrOzAV58vWFyyuweWYUHiR9WfcPRBfIQQ89OXhQPoWsnQ-siKV1m-NjLQJ...",
"snippet": "Zoho CRM and Zoho One as Alternatives: Zoho CRM and Zoho One are recommended as affordable alternatives to HubSpot, especially for...",
"source": "Reddit"
}source is not a domain. It is a publisher display name. Across all 57 citations we got values like Reddit, Slack, PCMag, Innowise, Stack Overflow, U.S. Chamber of Commerce, California State Portal | CA.gov and North Hollywood Toyota. Only 2 of 57 contained a dot at all.
This matters because it quietly changes what you can build. If your question is which brands are being cited for this query, source answers it and always did, and you never needed the URL. If your question is which specific page won the citation, source cannot answer it, and title only sometimes can. There is no field left that gives you the page for free.
We had this wrong in our own monitoring for three days. Our internal SERP probe was written to prefer link and fall back to source, on the assumption that source was a bare domain. It is not, and the fallback was silently producing publisher names where the code expected hostnames.
Three of our links were truncated, and that one is on us
Of the 57 citations, 3 did not carry a full token. They came back as literally https://www, https://www.google and https://www.go.
Those are goto URLs cut off mid-string, at three different offsets. They are not a Google behaviour we can point at and they are not a shape any downstream consumer can do anything with, because they parse as valid URLs with a plausible-looking host and then fail on request. A strict parser would accept all three. That is the worst possible failure mode.
We are logging it as our defect rather than dressing it up as an upstream quirk. Until it is fixed, the defensive check is cheap: treat any link under about 40 characters, or any link whose host is www or www.google with no path, as unusable rather than as a URL.
The truncation is deterministic, not random. Re-running the same query hours later put the same fragment on the same citation, which at least makes it reproducible enough to fix.
While checking this we found a second one worth admitting. We have documented a resolve_ai_overview flag that was supposed to expand citation tokens into publisher URLs. It does not work. The field is accepted, dropped without complaint, and absent from the search_parameters echo, and responses with it set to true are identical to responses without it. That is the same silent-drop behaviour we recently disclosed on num, which makes it a pattern rather than an incident: our request validator is ignoring unknown fields where it should be rejecting them. Do not pass the flag expecting resolution, and do not trust a parameter simply because it appears in a code sample. Check the search_parameters echo, which is the only honest statement of what a request actually did.
The token does resolve
The good news is that goto is not encryption. It is a redirect, and it behaves like one.
Requesting a token returns a single 302 with the destination sitting in plain text in the Location header:
HTTP/2 302
location: https://www.reddit.com/r/CRM/comments/1e5141p/best_and_inexpensive_crm_for_small_business/
server: gws
One hop, no chain, no JavaScript, no cookie requirement in our test. Read the Location header and stop; there is no reason to follow the redirect and pull the destination page unless you wanted it anyway.
The cost is in the volume. Our AI Overviews carried between 3 and 11 citations each, averaging 8. Resolving every citation on every tracked query means roughly eight additional requests per query, aimed at google.com, from infrastructure Google is already scrutinising. That is a rate-limiting problem you are choosing to buy, and it scales with your tracking set rather than with your actual need.
Which is why the resolution step should be conditional. Most citation tracking wants to know who got cited and how often. That question is fully answered by source and title at zero extra requests. Resolve the token when you need the page itself, for a content diff or a scrape of the cited article, and not before.
What this does not show
One run, twelve queries, one locale, one morning. Specifically:
- We did not re-run to see whether the same query produces goto tokens consistently. Given how much AI Overview presence itself varies between identical requests, some of the seven-versus-five split is likely sampling rather than a stable property of the query.
- We tested
gl=usandhl=enonly. Whether the rollout is uniform across locales is untested here. - We did not test whether tokens expire, or whether they are bound to a session or an IP. Ours resolved fine minutes after capture, which rules out a very short TTL and nothing more.
- Twelve queries cannot establish that AI Overview presence causes goto injection. It is a clean correlation in a small sample, and it is worth designing around while treating it as provisional.
What you now own
If you are tracking AI Overview citations, this week added a permanent job to your backlog. You now own a token-resolution layer: a request per citation, a Location header parse, a retry policy for when Google rate-limits the resolution traffic, and a truncation guard for links that look valid and are not. You own noticing the next time Google changes the token shape, which on the evidence of the last six weeks is a question of when. And you own the fact that none of this surfaces as an error, because every one of these responses is a 200 carrying a string that looks like a URL.
Scavio absorbs the fetch layer under that. The SERP request, the proxy and exit-node rotation, the AI Overview block resolving at all, and no_cache when you need a genuinely fresh draw are ours, at 1 credit per call, $0.01 per credit, no monthly commitment. A hundred tracked queries sampled five times daily is 500 credits a day, about $5, and when Google changes the shape again it is our on-call rather than your weekend. We are not yet resolving goto tokens server-side, and we are not going to claim we are while three of our own links are coming back truncated. Both are on the fix list, and this post will say so when they ship.
Start with 50 free credits, no card required — enough to run all twelve queries above four times over and check every number in this post against your own capture.
Endpoint reference lives in the Google Search API docs, and the companion piece on how many repeats a citation set actually needs covers the sampling side of the same problem.