# Connect Google Workspace as your identity provider
URL: https://docs.autociso.io/product/sso/google-workspace/
Description: Set up AutoCISO so your team signs in with their Google Workspace accounts, using your own Google OAuth client rather than AutoCISO's.

This connects AutoCISO to **your** Google Cloud OAuth client, so your IT team
controls the app, your conditional-access rules apply, and disabling someone in
Google Workspace stops them signing in to AutoCISO.

This is different from the "Google" option that has always been in Allowed
Providers — that one authenticates against AutoCISO's own Google app.

Requires [The Growth plan or higher](https://docs.autociso.io/getting-started/plans-and-features/) and the [**Owner** role](https://docs.autociso.io/getting-started/roles-and-permissions/) in AutoCISO. The sign-in settings used here are explained in [Single Sign-On](https://docs.autociso.io/product/sso/overview/).

## Before you start

You need administrator access to a Google Cloud project in the same
organization as your Google Workspace tenant.

## 1. Start the connection in AutoCISO

1. Go to **user menu → [Organization Settings](https://docs.autociso.io/console/settings/organization/) → Sign-In Policy**.
2. In the **Single Sign-On** section choose **Google Workspace**.
3. Leave the form open — you need the **Redirect URI** from it in a moment.

Because you have not saved yet, the Redirect URI is not shown. It is the same
for every Google connection on AutoCISO:

```
https://auth.autociso.io/ui/login/login/externalidp/callback
```

## 2. Create the OAuth client in Google Cloud

1. Open [Google Cloud Console](https://console.cloud.google.com/) and select
   your project.
2. Go to **APIs & Services → Credentials**.
3. Select **Create credentials → OAuth client ID**.
4. Application type: **Web application**.
5. Name it something recognisable, for example `AutoCISO SSO`.
6. Under **Authorised redirect URIs**, add exactly:
   `https://auth.autociso.io/ui/login/login/externalidp/callback`
7. Select **Create**, then copy the **Client ID** and **Client secret**.

Treat the client secret like a password. Do not email it or paste it into a
ticket — put it straight into the next step.

## 3. Finish the connection in AutoCISO

1. Back on **Sign-In Policy**, paste the **Client ID** and **Client secret**.
2. Give the connection a name your team will recognise on the sign-in screen,
   for example `Acme Google`.
3. Decide on **Create accounts automatically on first sign-in**:
   - **Off** (default) — people need an invitation first. Safer for a first
     rollout.
   - **On** — anyone in your Google Workspace who reaches AutoCISO gets an
     account at the role you pick. Start with **Member**.
4. Select **Save**.

The connection is now **Pending**.

## 4. Test it

Select **Test connection**. On success the status becomes **Active**.

A failure here almost always means one of:

- the redirect URI in Google does not match exactly (a trailing slash counts),
- the client secret was pasted with whitespace, or
- the OAuth client was created in a different Google project than you expected.

## 5. Offer it to your team

1. In **Allowed Providers**, select your new connection.
2. Keep **Email / Password** selected for now.
3. Select **Save**.

See [Single Sign-On](https://docs.autociso.io/product/sso/overview/) for how Allowed Providers works.

Sign out and sign back in through your organization's sign-in link — the
copyable link further down the same page — to confirm the Google option appears
and works.

## 6. Make it the only way in (optional)

Once you have confirmed that you and at least one other Owner can sign in with
Google (invite one in [User Management](https://docs.autociso.io/console/settings/members/) if needed):

1. Deselect **Email / Password** in Allowed Providers.
2. Select **Save** and confirm the warning.

Your team is now Google-only. If you ever need password sign-in back, see
[If you lock yourself out](https://docs.autociso.io/product/sso/overview/#if-you-lock-yourself-out).

## Restricting to your domain (optional)

Add the domains you use, for example `acme.com`, in the **Email domains** section. The rules for this restriction are in [Single Sign-On](https://docs.autociso.io/product/sso/overview/#3-email-domains).