SSO with Google Workspace
Configure Google Workspace (Google Cloud OAuth) as an OIDC SSO provider for dFlow.
Use this walkthrough to fill out Account → Single Sign-On → Add OIDC for Google Workspace.
1. Google Cloud Console (do this first)
-
Open Google Cloud Console → APIs & Services → Credentials.
-
Create an OAuth 2.0 Client ID, type Web application.
-
Before you can fill in the redirect URI, pick your Provider ID in the dFlow form (for example
acme-google). The modal shows the URI live:https://app.dflow.sh/api/auth/sso/callback/acme-googleUse your own dFlow host if you are self-hosted or on staging.
-
Paste that exact URI into Authorized redirect URIs in Google Cloud Console and save.
-
Copy the generated Client ID and Client Secret.
If the OAuth consent screen is still in Testing mode, only test users you explicitly added can sign in. Add your team as test users, or publish the app once setup works.
2. Fill in the dFlow modal
| Field | Value |
|---|---|
| Provider ID | acme-google (or whatever you chose; this locks in the redirect URI) |
| Email domains | acme.com, acme.co — your Workspace domain(s) |
| Issuer URL | https://accounts.google.com |
| Client ID | from Google Cloud Console |
| Client secret | from Google Cloud Console |
| Scopes | openid email profile (default is fine) |
| Token auth method | client_secret_basic (Google supports this) |
| Discovery endpoint | leave optional — Google publishes discovery at https://accounts.google.com/.well-known/openid-configuration |
| Authorization / Token / JWKS endpoints | leave blank — discovery fills these in |
| Use PKCE | keep it On |
| Skip discovery | leave Off |
3. Trusted origins
dFlow adds the issuer origin automatically when you save. Confirm https://accounts.google.com appears under Trusted origins. If it is missing, add it and click Add origin.
4. Save and test
- Click Add provider.
- Sign out, then on the dFlow sign-in screen enter an email on your Workspace domain (for example
[email protected]). - You should redirect to Google, authenticate, and bounce back to the callback URL signed in.
SAML instead of OIDC
If you prefer Google as a SAML IdP, use Add SAML instead. You need the Entry point / SSO URL, IdP certificate (PEM), and optionally metadata XML from the Google Admin SAML app. See SSO with any OIDC or SAML provider.
Related
- Enterprise SSO — overview, redirect URI rules, troubleshooting
- SSO with any OIDC or SAML provider