Connect Google Workspace as your identity provider

This connects autociso to your Google Cloud OAuth client, so your IT team controls the app, your conditional-access rules apply, and disabling someone in Google Workspace stops them signing in to autociso.

This is different from the “Google” option that has always been in Allowed Providers — that one authenticates against autociso’s own Google app.

Requires the Growth or Scale plan, and the Owner role in autociso.

Before you start

You need administrator access to a Google Cloud project in the same organization as your Google Workspace tenant.

1. Start the connection in autociso

1. Go to Organization → Sign-In Policy.
2. In the Single Sign-On section choose Google Workspace.
3. Leave the form open — you need the Redirect URI from it in a moment.

Because you have not saved yet, the Redirect URI is not shown. It is the same for every Google connection on autociso:

https://auth.autociso.io/idps/callback

2. Create the OAuth client in Google Cloud

1. Open Google Cloud Console and select your project.
2. Go to APIs & Services → Credentials.
3. Select Create credentials → OAuth client ID.
4. Application type: Web application.
5. Name it something recognisable, for example autociso SSO.
6. Under Authorised redirect URIs, add exactly: https://auth.autociso.io/idps/callback
7. Select Create, then copy the Client ID and Client secret.

Treat the client secret like a password. Do not email it or paste it into a ticket — put it straight into the next step.

3. Finish the connection in autociso

1. Back on Sign-In Policy, paste the Client ID and Client secret.
2. Give the connection a name your team will recognise on the sign-in screen, for example Acme Google.
3. Decide on Create accounts automatically on first sign-in:
   • Off (default) — people need an invitation first. Safer for a first rollout.
   • On — anyone in your Google Workspace who reaches autociso gets an account at the role you pick. Start with Member.
4. Select Save.

The connection is now Pending.

4. Test it

Select Test connection. On success the status becomes Active.

A failure here almost always means one of:

• the redirect URI in Google does not match exactly (a trailing slash counts),
• the client secret was pasted with whitespace, or
• the OAuth client was created in a different Google project than you expected.

5. Offer it to your team

1. In Allowed Providers, select your new connection.
2. Keep Email / Password selected for now.
3. Select Save.

Sign out and sign back in through your organization’s sign-in link — the copyable link further down the same page — to confirm the Google option appears and works.

6. Make it the only way in (optional)

Once you have confirmed that you and at least one other Owner can sign in with Google:

1. Deselect Email / Password in Allowed Providers.
2. Select Save and confirm the warning.

Your team is now Google-only. If you ever need password sign-in back, the Restore email & password sign-in button on this page does exactly that, on any plan.

Restricting to your domain (optional)

In Email domains, add the domains you use, for example acme.com. Anyone whose address is outside the list is refused. autociso will not let you save a list that excludes an Owner — including you.