---
title: "Configuring Google Workspace for Verax"
slug: "google-workspace-idp"
updated: 2026-09-07T13:15:38Z
published: 2026-09-07T13:15:38Z
canonical: "docs.verax.ai/google-workspace-idp"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.verax.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Google Workspace for Verax

This guide explains how to connect Google Workspace to Verax.

Once completed, the integration enables:

- **Console Authentication (SSO)** for Verax Protect users.
- **User & Group Synchronization**.
- **Identity Enforcement**.

---

## Before You Begin

Ensure you have:

- Google Workspace Super Admin permissions.
- Access to Google Cloud Console.
- Permission to create OAuth credentials and Service Accounts.
- Permission to enable Google APIs.

---

## Step 1. Enable the Admin SDK API

The Admin SDK API is required for user and group synchronization.

1. Open **Google Cloud Console**.
2. Navigate to **APIs & Services → Library**.
3. Search for **Admin SDK API**.
4. Click **Enable**.

> **Important**
> 
> If the Admin SDK API is not enabled, directory scopes will not be available later in the configuration.

---

## Step 2. Configure the OAuth Consent Screen

The OAuth Consent Screen defines your application's identity and the permissions requested during sign-in.

Navigate to:

**APIs & Services → OAuth consent screen**

Configure:

### Branding

- App name
- Support email
- Developer contact email
- (Optional) Logo

### Audience

Select:

**Internal**

This ensures only users in your Google Workspace can authenticate.

### Data Access

Add the following OAuth scopes.

**Console Authentication (OIDC)**

```plaintext
openid
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile
```

**Directory Access**

```plaintext
https://www.googleapis.com/auth/admin.directory.group.readonly
```

Click **Save**.

---

## Step 3. Create the OAuth Client

The OAuth Client enables **Console Authentication (SSO)**.

1. Navigate to:

**APIs & Services → Credentials**

1. Select:

**Create Credentials → OAuth Client ID**

1. Choose:

**Web Application**

1. Configure the following redirect URI:

```plaintext
https://console.verax.ai:3002/auth/sso/GOOGLE/callback
https://internal.verax.ai/oidc/callback
```

1. Save:

- Client ID
- Client Secret

These values will be entered into Verax.

> **Note**
> 
> If the OAuth Consent Screen is still in **Testing** mode, add every user that needs to sign in to Verax as a Test User. Otherwise, Google will block authentication.

---

## Step 4. Create the Service Account

The Service Account enables **User & Group Synchronization** and **Identity Enforcement**.

Navigate to:

**IAM & Admin → Service Accounts**

Create a new Service Account.

No IAM roles are required.

---

## Step 5. Generate the Service Account Key

Open the Service Account.

Navigate to:

**Keys → Add Key → Create new key → JSON**

Download the JSON key.

You'll upload this file into Verax later.

Copy the Service Account **OAuth 2 Client ID** (Unique ID).

You'll use it in the next step.

---

## Step 6. Configure Domain-wide Delegation

Open:

**Google Workspace Admin Console**

Navigate to:

**Security → API Controls → Domain-wide Delegation**

Add a new client.

Client ID:

```plaintext
<Service Account OAuth Client ID>
```

Scopes:

```plaintext
https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly
```

Click **Authorize**.

---

## Step 7. Choose the Service Administrator

Verax performs directory synchronization by impersonating a Google Workspace administrator.

We recommend creating a dedicated service account, for example:

```plaintext
verax-svc-auth-manager@company.com
```

Grant only the minimum permissions required to read users and groups.

Using a dedicated account improves auditing and separates automated activity from human administrators.

---

## Step 8. Configure Verax

Navigate to:

**Settings → Identity Provider**

Select:

**Google Workspace**

Provide:

| Verax Setting | Google Value |
| --- | --- |
| Client ID | OAuth Client ID |
| Client Secret | OAuth Client Secret |
| Service Account Key | Service Account JSON |
| Service Admin Email | Administrator email used for impersonation |

Save the connector.

---

## Step 9. Enable Identity Provider Features

Once the connector has been successfully configured, you can independently enable:

- **Console Authentication (SSO)**
- **Identity Enforcement**

---

## Verify the Integration

Confirm that:

- Verax users can sign in using Google Workspace.
- Users and groups synchronize successfully.
- Identity Enforcement is operating for supported AI tools.