How do I let customers use Google Workspace for login?

To let customers sign in with Google Workspace, you typically add “Sign in with Google” using Google’s OAuth 2.0 / OpenID Connect flow.

If your customers are on Google Workspace

They can use their existing company Google account to log in, and you can optionally:

• allow only specific Workspace domains
• let users log in with any Google account
• map Google identity to an existing customer account in your app

High-level steps

1) Create a Google Cloud project

Go to the Google Cloud Console and create/select a project.

2) Configure the OAuth consent screen

Set up the app name, support email, and authorized domains.

3) Create OAuth credentials

Create an OAuth 2.0 Client ID for your app:

• Web app for server-side apps
• iOS/Android for mobile apps

Add your redirect URI exactly as your app will use it.

4) Request the right scopes

Usually you only need:

• openid
• email
• profile

That’s enough to identify the user.

5) Implement the login flow

Typical flow:

1. User clicks Continue with Google
2. Redirect them to Google’s authorization URL
3. Google sends them back with an authorization code
4. Your backend exchanges that code for tokens
5. Verify the ID token
6. Create or link the user account in your system

6) Restrict to your customers’ Workspace domains

If you only want business users from specific companies, check one or both of:

• hd parameter in the login request to suggest a Workspace domain
• the hd claim in the ID token to verify the user’s hosted domain

Important: hd is a hint, not sufficient by itself for security. Always verify the token and validate the domain server-side.

What you should verify

When you receive the ID token, verify:

• signature is valid
• iss is Google
• aud matches your client ID
• token is not expired
• email_verified is true
• hd matches an allowed Workspace domain if you restrict access

Common product patterns

For customer-facing SaaS

• allow Google login
• map users to an organization
• auto-create a tenant when a first user from a Workspace domain signs up
• optionally require domain verification for admin setup

For enterprise-only access

• enforce allowed domains
• add SCIM or SSO later if needed
• consider Google Workspace SAML if the customer wants centralized enterprise SSO

If you want the easiest implementation

Use a library or managed auth provider such as:

• Google Identity Services directly
• Auth0
• Firebase Authentication
• Clerk
• Supabase Auth
• NextAuth/Auth.js

These handle most of the OAuth and token verification for you.

Minimal example conceptually

Your app should:

• send users to Google’s auth endpoint
• handle the callback
• exchange code for tokens
• verify ID token
• extract:
  • sub for unique Google user ID
  • email
  • name
  • picture
  • hd for Workspace domain

If you want, I can give you:

1. a step-by-step setup in Google Cloud, or
2. sample code for your stack (Node, Python, PHP, Ruby, Go, etc.).