Connect Google Workspace with OpenID Connect

Google Workspace connects most simply over OpenID Connect, using an OAuth client from the Google Cloud Console.

1. In Google Cloud Console, under APIs & Services → Credentials, create an OAuth client ID of type Web application.
2. Open Settings → Organization here, choose OpenID Connect under Single sign-on, and save — that reveals our redirect URI. Add it to the client's authorized redirect URIs in Google.
3. Back here, set the issuer URL to https://accounts.google.com and paste the client's client ID and client secret.
4. Save, run the test, and enable the connection.

Staff then sign in from our SSO page with their work email and land on the familiar Google account chooser. First-time users are added to your organization automatically, seats permitting, with their email treated as verified — Google has already done that part.

If you'd rather manage the connection from the Google Admin console as a SAML app instead, that works too: choose SAML here and use Google's IdP metadata (entity ID, SSO URL, and certificate) exactly as in the Okta and Entra walkthroughs — the fields are the same three, just under Google's labels.

Google Workspace has no SCIM path to us, so for roster automation pair SSO with the CSV import, or simply let SSO auto-provision people the first time they sign in.