Google Workspace
Google Workspace signs in with OIDC. Because Google's sign-in doesn't send group membership, roles and teams for Google users come from directory sync.
1. Create an OAuth client
In the Google Cloud console, in a project owned by your Workspace:
- APIs & Services → OAuth consent screen: user type Internal.
- Credentials → Create credentials → OAuth client ID → Web application.
- Authorized redirect URIs:
https://<workspace>.waxell.dev/api/waxell/v1/auth/sso/callback/ - Copy the Client ID and Client secret.
2. Add the provider in Waxell
Settings → Identity → Add OIDC provider:
| Field | Value |
|---|---|
| Issuer URL | https://accounts.google.com |
| Client ID / secret | from step 1 |
| Scopes | leave blank (openid email profile) |
| Email domains | your Workspace domain, for example acme.com |
Tick Enabled, Save, then Test.
3. Sign in
At https://<workspace>.waxell.dev/login, type your Google Workspace email and
click Continue with SSO.
Sign in with Google vs. Google SSO
The Sign in with Google button signs in an individual Google account. Google SSO (this page) is configured by your admin, routes your whole domain, and can be enforced. Enforcing SSO turns off the Sign in with Google button for your domain on that workspace.
Next
Sync users and groups from Google to give people roles and teams automatically.