Set Up SSO with Google Workspace

This guide is for the Google Workspace super administrator. Replace <ORG-ID> with your TestInvite organization ID.

Option A — SAML 2.0 (custom SAML app)

1. Google Admin console → Apps → Web and mobile apps → Add app → Add custom SAML app.
2. App name TestInvite → Continue.
3. Google Identity Provider details: click Download metadata (file GoogleIDPMetadata.xml) → Continue.
4. Service provider details: ACS URL https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/acs; Entity ID https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/metadata; Start URL https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/initiate; leave Signed response unchecked; Name ID format EMAIL; Name ID Basic Information › Primary email → Continue.
5. Attribute mapping: Primary email → email, First name → firstName, Last name → lastName → Finish.
6. Open the app → User access → turn it ON for everyone (or for selected organizational units / groups). Changes can take a few minutes, occasionally up to 24 hours, to reach all users.

In TestInvite, protocol SAML 2.0 → Upload metadata XML → choose GoogleIDPMetadata.xml. The Entity ID looks like https://accounts.google.com/o/saml2?idpid=…. Google's certificate is valid for 5 years; when you renew it in Google, download the metadata again and upload it to TestInvite.

Option B — OpenID Connect

1. Google Cloud console (a project owned by your Workspace organization) → APIs & Services → OAuth consent screen: user type Internal.
2. Credentials → Create credentials → OAuth client ID → application type Web application → Authorized redirect URI https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/oidc/callback → Create.
3. Copy the client ID and client secret.

In TestInvite: Issuer URL https://accounts.google.com, client ID and secret, client authentication Basic, scopes openid email profile. Because Google accounts exist outside your company too, the email domains setting is what limits sign-in to your Workspace addresses — list only your own domains.