​

Google Workspace (SSO) Integration

​

Prerequisites

• A Google Cloud project inside your Google Workspace organization, and permission to configure Google Auth Platform and create OAuth clients in it (for example the project Owner or Editor role).
• Administrator access to SecureAI, with Admin permission on the Integrations section.

​

How it works

1. You create an OAuth 2.0 client of type “Web application” in Google Cloud. SecureAI uses OpenID Connect with the openid, email and profile scopes.
2. In SecureAI you enter the Client ID, the Client secret and your Google Workspace domains. The secret is stored encrypted and is never shown again.
3. When a user clicks Continue with Google, Google authenticates them and SecureAI lets them in only if:
   • Google verified their email,
   • the account is managed by one of your Workspace domains (the hd claim), and
   • their email matches an active SecureAI account.

​

Step 1: Copy the redirect URI from SecureAI

1. Sign in to SecureAI as an administrator.
2. Go to Admin → Integrations and filter by the IAM category.
3. On the Google Workspace (SSO) card, click Connect Integration (or Reconfigure, if the card says Configured by Hiper AI).
4. In section 1. Create an OAuth client in Google Cloud, click Copy next to the Redirect URI.

https://<your-company>.hiperai.ai/api/auth/google/callback

​

Step 2: Choose or create a Google Cloud project

1. Open the Google Cloud console.
2. In the project picker on the top bar, choose a project in your organization or click New Project.

3. If you create one: name it (for example SecureAI SSO), check that the Organization is your Google Workspace one, and click Create.

​

Step 3: Configure Google Auth Platform (consent screen)

1. In the menu, go to APIs & Services → OAuth consent screen (called Google Auth Platform in the new console). If it is the first time, click Get started.

2. App information: an app name (for example SecureAI) and a user support email.
3. Audience: choose Internal. Only accounts in your Google Workspace organization can use the app, and Google does not require app verification.
4. Contact information: an email for notices from Google.
5. Accept the user data policy and click Create.

​

Step 4: Create the OAuth client

1. In Google Auth Platform, go to Clients (or APIs & Services → Credentials → + Create credentials → OAuth client ID).

2. Click + Create client.
3. Application type: Web application.
4. Name: for example SecureAI SSO.
5. Under Authorized redirect URIs, click + Add URI and paste the URI from step 1. (You do not need Authorized JavaScript origins.)

6. Leave Use this client for an AI-powered agent unchecked: it is for a different kind of client and SecureAI does not need it.
7. Click Create.
8. In the dialog that appears, copy the Client ID (ends in .apps.googleusercontent.com) and the Client secret (starts with GOCSPX-). You can download the JSON as a backup. Do not close the dialog until you have copied it.

​

Step 5: Enter the details in SecureAI and test

1. In 2. Paste the OAuth client details, fill in:
   • Client ID: from step 4.
   • Client secret: from step 4.
   • Allowed email domains (required): your primary Google Workspace domain and, if you use them, your secondary domains, comma-separated. For example contoso.com, contoso.co.uk.
2. In 3. Test the connection, click Test connection. SecureAI asks Google (without signing anyone in) and checks:

   Check	If it fails
   Client ID	Google does not know that client (invalid_client). Check that you copied the full ID and that the client is not deleted or disabled.
   Redirect URI registered on the client	The URI from step 1 is not in Authorized redirect URIs (redirect_uri_mismatch). Add it exactly and wait a few minutes.
   Client secret	The secret does not belong to that client (invalid_client). Paste it again or add a new one.

   The test uses what is typed in the form, so you can test before saving.
3. Check that Show “Continue with Google” on the login page is on (it starts on the first time). SecureAI will not save it on without at least one domain.
4. Click Save.

​

Step 6: Add your users

• Existing users: people who already have a SecureAI account (even with a password) are not recreated. They can keep signing in with their password, and also with Google.
• New SSO-only users: in Admin → IAM Management → User Management → Add User, choose the authentication method Business Account / SSO. The user does not get an email to create a password and signs in directly with Continue with Google.

​

Test the sign-in

1. Open your instance’s login page in an incognito window.
2. Click Continue with Google.
3. Pick your Google Workspace account.
4. Google sends you back to SecureAI, signed in.

​

Disable or remove the integration

• To hide the button but keep the configuration, turn the switch off and save.
• To delete it, use Remove configuration. If your instance previously had SSO configured by Hiper AI, that configuration applies again.

​

Rotate the client secret

1. In Google Cloud, open the OAuth client and click Add secret (the old one keeps working).
2. In SecureAI, paste the new value into Client secret, click Test connection and then Save. Leaving the field empty keeps the current secret.
3. Once you have confirmed that sign-in works, disable and delete the old secret in Google Cloud.

​

If your instance already had SSO configured by Hiper AI

​

Troubleshooting

• Error 400: redirect_uri_mismatch: the client’s redirect URI is not exactly the one from step 1. Fix it under Authorized redirect URIs (not JavaScript origins).
• Error 403: org_internal: the app is Internal and the account does not belong to the Google Cloud organization that owns the project. This also happens when your company has more than one Google organization (for example company.com and company.ai) and the OAuth client was created in a project of the other one: create it in a project of the organization your users belong to (the console’s project picker shows each project’s organization).
• Error 401: invalid_client / deleted_client: the OAuth client does not exist or was deleted. Create a new one and update SecureAI.
• “Access blocked: your administrator has not trusted this app”: your Workspace’s app access controls block third-party apps. In the Google Admin console (Security → Access and data control → API controls → Manage third-party app access), mark the client ID as Trusted.

​

Additional resources

• Setting up OAuth 2.0 in Google Cloud
• OpenID Connect at Google
• Control which third-party apps access Google Workspace data