Configuring Google Workspace for Verax

This guide explains how to connect Google Workspace to Verax.

Once completed, the integration enables:

• Console Authentication (SSO) for Verax Protect users.

• User & Group Synchronization.

• Identity Enforcement.

Before You Begin

Ensure you have:

• Google Workspace Super Admin permissions.

• Access to Google Cloud Console.

• Permission to create OAuth credentials and Service Accounts.

• Permission to enable Google APIs.

Step 1. Enable the Admin SDK API

The Admin SDK API is required for user and group synchronization.

1. Open Google Cloud Console.

2. Navigate to APIs & Services → Library.

3. Search for Admin SDK API.

4. Click Enable.

Important

If the Admin SDK API is not enabled, directory scopes will not be available later in the configuration.

Step 2. Configure the OAuth Consent Screen

The OAuth Consent Screen defines your application's identity and the permissions requested during sign-in.

Navigate to:

APIs & Services → OAuth consent screen

Configure:

Branding

• App name

• Support email

• Developer contact email

• (Optional) Logo

Audience

Select:

Internal

This ensures only users in your Google Workspace can authenticate.

Data Access

Add the following OAuth scopes.

Console Authentication (OIDC)

openid
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile

Directory Access

https://www.googleapis.com/auth/admin.directory.group.readonly

Click Save.

Step 3. Create the OAuth Client

The OAuth Client enables Console Authentication (SSO).

1. Navigate to:

APIs & Services → Credentials

2. Select:

Create Credentials → OAuth Client ID

3. Choose:

Web Application

4. Configure the following redirect URI:

https://console.verax.ai:3002/auth/sso/GOOGLE/callback
https://internal.verax.ai/oidc/callback

5. Save:

• Client ID

• Client Secret

These values will be entered into Verax.

Note

If the OAuth Consent Screen is still in Testing mode, add every user that needs to sign in to Verax as a Test User. Otherwise, Google will block authentication.

Step 4. Create the Service Account

The Service Account enables User & Group Synchronization and Identity Enforcement.

Navigate to:

IAM & Admin → Service Accounts

Create a new Service Account.

No IAM roles are required.

Step 5. Generate the Service Account Key

Open the Service Account.

Navigate to:

Keys → Add Key → Create new key → JSON

Download the JSON key.

You'll upload this file into Verax later.

Copy the Service Account OAuth 2 Client ID (Unique ID).

You'll use it in the next step.

Step 6. Configure Domain-wide Delegation

Open:

Google Workspace Admin Console

Navigate to:

Security → API Controls → Domain-wide Delegation

Add a new client.

Client ID:

<Service Account OAuth Client ID>

Scopes:

https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly

Click Authorize.

Step 7. Choose the Service Administrator

Verax performs directory synchronization by impersonating a Google Workspace administrator.

We recommend creating a dedicated service account, for example:

verax-svc-auth-manager@company.com

Grant only the minimum permissions required to read users and groups.

Using a dedicated account improves auditing and separates automated activity from human administrators.

Step 8. Configure Verax

Navigate to:

Settings → Identity Provider

Select:

Google Workspace

Provide:

Save the connector.

Step 9. Enable Identity Provider Features

Once the connector has been successfully configured, you can independently enable:

• Console Authentication (SSO)

• Identity Enforcement

Verify the Integration

Confirm that:

• Verax users can sign in using Google Workspace.

• Users and groups synchronize successfully.

• Identity Enforcement is operating for supported AI tools.