/ Docs
Vendor Integrations

Google SSO

Last updated October 13, 2025 · View as Markdown

Set up Google Single Sign-On Integration Google Single Sign-On (SSO) enables users to log in to multiple apps with their Google credentials, simplifying access and enhancing security through features like two-factor authentication (2FA).

In order to integrate Google SSO with Relyance AI you will need:

  • A client Secret
  • A client ID
  • Domain name
  • Admin SDK API

In some instances, you may need to grant permissions to the Relyance Google App. Please have your Google workspace admin configure the trust relationship as outlined here.

In your Google Cloud Console:

  1. Create a Google Cloud Project:

    1. Go to the Google Cloud Console (console.cloud.google.com), navigate to "IAM & Admin", click then in "Manage Resources".

    2. Click on "Create Project" and give it a name.

      • You can do this on an existing project but we advise creating a new one for easier management of the integration/troubleshooting

    3. Enable the Google Workspace Admin SDK API:

      • In the Google Cloud Console, navigate to the API Library APIs & Services, click on "Enable APIs and Services".
      • Search for Google Workspace API "Admin SDK API" and enable it.

    4. Create consent screen:

      • In the Google Cloud Console, navigate to the API Library APIs & Services, click on "OAuth Consent Screen".
      • Select Internal for User Type.
      • Fill in the required fields for the consent screen page such as App name, User Support Email, Developer contact information. Click Save and continue.
      • On scopes, click save and continue and then click back to the dashboard.

    5. Create OAuth 2.0 Client ID:

      • In the Google Cloud Console, go to the Credentials page under APIs & Services, and click on "Credentials".
      • Click on "Create Credentials" and select "OAuth client ID".
      • Choose the application type as Web Application
      • Fill in the required fields and update Authorized redirect URIs with: https://root.relyance.ai/api/oauth2
      • Generate Client Secret: After creating the client ID, you'll be prompted to generate a client secret. This secret is highly confidential and should be stored securely. In the Relyance AI tenant:

In your Google workspace (optional):

gdrivepre-1.png Our OAuth2.0 application needs to be trusted explicitly by the administrator of the Google workspace (our Google App Verification Request is in progress). You may need to involve the Google workspace administrator.

gdrivepre-3.png

gdrivepre-5.png

  1. Navigate to Security > API Controls in your Google Admin console Home page.

  2. Click on MANAGE THIRD-PARTY APP ACCESS.

  3. Click on Configure new app dropdown and select OAuth App Name Or Client ID.

gdrivepre-2.png

  1. In the resulting screen, search for the following client ID (the Relyance AI client ID for Google Drive):
892114676652-slst0t12i39117d4qvdg8rm3sjlnldlf.apps.googleusercontent.com

  1. The app should be displayed below.

  2. Click on Select.

  3. Check the Client ID to configure, and click on Select at the bottom.

gdrivepre-4.png

  1. Select Trusted: Can access all Google services.

  2. Click on Confirm.

  3. Ensure the Access column for the Relyance AI app is Trusted.

gdrivepre-6.png

In the Relyance AI application:

  1. Login to your Relyance account.
  2. Navigate to the Settings Menu in the bottom left-hand side.
  3. Select Integrations.
  4. Search for the Google SSO integration card and click it to open its connections.
  5. On the Authentication step, pick the method under Authentication Method., select the OAuth2.0/App Token option
  6. Add the domain <companyname.xyz>
  7. Add the client secret and client ID generated from your Google Cloud project
  8. Click Connect

Congratulations, you are now connected to Google SSO

Authentication methods and fields

Pick one of these under Authentication Method on the connection wizard's Authentication step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

Method Required Optional
Oauth2 / App Token Domain, Client ID, Client Secret (secret) —

Verify the connection is really working

The connection uses two scopes: admin.directory.user.readonly and feeds.domain.

  1. A failure at Authenticate is usually the Domain field. It must be the primary domain of the Workspace account, not an alias and not a user's email domain if they differ.
  2. Connected but no users discovered means the OAuth client was not authorised for the directory scope in the Admin console. In Workspace, a client ID has to be granted its scopes under Security › API controls › Domain-wide delegation — the client existing is not the same as the client being trusted, and the difference shows up as an empty result rather than an error.
  3. The account that authorises matters. The consent must come from an administrator with directory read rights; a non-admin can complete the flow and produce a connection that can see nothing.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

The OAuth (browser authorization) method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (terraform import relyance_integration_connection.example google_sso/<connection_id>) or reading it with the relyance_integration_connection data source.

← Previous
Google Cloud Storage