SecurityEnterprise SSOGoogle Workspace

Google Workspace SSO Setup (OAuth 2.0)

This guide walks you through configuring Google Workspace as your identity provider for Ledly using OAuth 2.0.

Google Workspace SSO requires Google Cloud Console access and a Ledly Enterprise plan ($1,999/mo).

Prerequisites

  • Google Cloud Console access (Owner or Editor role)
  • Google Workspace domain
  • Ledly organization administrator access
  • Ledly Enterprise plan ($1,999/mo)

Configuration Values

You’ll need this Ledly value when configuring Google:

SettingValue
Authorized redirect URIhttps://ledlyv2-production.up.railway.app/api/sso/google/callback

Step 1: Create Google Cloud Project

If you don’t already have a project for your organization’s integrations:

Navigate to Google Cloud Console

Go to console.cloud.google.com

Create a new project (or select existing)

  1. Click the project dropdown at the top
  2. Click New Project
  3. Enter a project name (e.g., “Ledly SSO”)
  4. Select your organization
  5. Click Create

Select the project

Ensure your new project is selected in the project dropdown.

Step 2: Configure OAuth Consent Screen

Navigate to OAuth consent screen

  1. In the left sidebar, go to APIs & Services → OAuth consent screen

Select user type

  • For Google Workspace users only: Select Internal
  • For any Google account: Select External (requires verification for production)

Click Create.

Configure consent screen

Fill in the required fields:

FieldValue
App nameLedly
User support emailYour support email
App logo(Optional) Upload Ledly logo
App domainledly.io
Authorized domainsledly.io
Developer contact emailYour email

Click Save and Continue.

Configure scopes

  1. Click Add or Remove Scopes

  2. Add these scopes:

    • email - See your primary Google Account email address
    • profile - See your personal info (name, profile picture)
    • openid - Associate you with your personal info on Google

  3. Click Update

  4. Click Save and Continue

Test users (External only)

If you selected External user type and are in testing mode:

  1. Add test users who can use the app before verification
  2. Click Add Users
  3. Enter email addresses of testers

Click Save and Continue.

Summary

Review your settings and click Back to Dashboard.

For production use with External user type, you’ll need to submit for Google verification. Internal apps (Google Workspace only) don’t require verification.

Step 3: Create OAuth Credentials

Navigate to Credentials

  1. In the left sidebar, go to APIs & Services → Credentials

Create OAuth client ID

  1. Click Create Credentials at the top
  2. Select OAuth client ID

Configure OAuth client

FieldValue
Application typeWeb application
NameLedly SSO

Add Authorized redirect URI

  1. Under Authorized redirect URIs, click Add URI
  2. Enter: https://ledlyv2-production.up.railway.app/api/sso/google/callback

Click Create.

Copy credentials

A dialog will appear with your credentials:

CredentialDescription
Client IDYour OAuth client ID (ends in .apps.googleusercontent.com)
Client SecretYour OAuth client secret

Click Download JSON to save a backup, then click OK.

⚠️

Keep your Client Secret secure. Anyone with this secret could potentially impersonate your application.

Step 4: Configure Ledly

Now configure Ledly to use your Google OAuth application:

Navigate to SSO Settings

  1. Log in to Ledly at app.ledly.io
  2. Go to Settings → SSO

Select Google Workspace

Select Google Workspace (OAuth 2.0) as your identity provider.

Enter Configuration Values

Enter the values you collected from Google Cloud Console:

FieldValue
Client IDYour OAuth client ID
Client SecretYour OAuth client secret

Configure SSO Options

OptionRecommended Setting
Auto-provision usersEnabled - Creates accounts for new SSO users
Default roleMember - New users start with member permissions
Allow password loginYour choice - Enable for fallback access

Save Configuration

Click Save to apply the SSO configuration.

Step 5: Test SSO

Test with an Admin Account First

  1. Open an incognito/private browser window
  2. Navigate to your Ledly login page
  3. Click Sign in with SSO or enter your email
  4. Verify you’re redirected to Google sign-in
  5. Sign in with your Google Workspace account
  6. If prompted, consent to the permissions requested
  7. Confirm you’re redirected back to Ledly and logged in

Verify User Attributes

After logging in via SSO:

  1. Go to Settings → Profile
  2. Verify your name and email were populated correctly

Test JIT Provisioning (Optional)

  1. Have a user who doesn’t have a Ledly account sign in via SSO
  2. Verify their account was automatically created

Configuration Reference

OAuth Endpoints

Google uses standard OAuth 2.0/OIDC endpoints:

EndpointURL
Discoveryhttps://accounts.google.com/.well-known/openid-configuration
Authorizationhttps://accounts.google.com/o/oauth2/v2/auth
Tokenhttps://oauth2.googleapis.com/token
UserInfohttps://openidconnect.googleapis.com/v1/userinfo

Requested Scopes

Ledly requests the following OAuth scopes:

ScopePurpose
openidRequired for OIDC
profileAccess to user’s name and profile picture
emailAccess to user’s email address

Token Lifetimes

TokenDefault Lifetime
Access token1 hour
Refresh tokenNo expiration (until revoked)
ID token1 hour

Restricting to Google Workspace Domain

To ensure only users from your Google Workspace domain can sign in:

Option 1: Use Internal App (Recommended)

When you set the OAuth consent screen to Internal, only users in your Google Workspace organization can use the app.

Option 2: Domain Verification in Ledly

Ledly validates that the email domain matches your organization’s configured domain(s). Contact support to configure domain restrictions.

Option 3: Google Workspace Admin Controls

In Google Workspace Admin:

  1. Go to Security → API Controls → App Access Control
  2. Configure which apps are allowed for your organization

Google Workspace Admin Settings

Configuring App Access

As a Google Workspace admin, you can control access to Ledly:

Navigate to Admin Console

Go to admin.google.com

Configure app access

  1. Go to Security → Access and data control → API controls
  2. Click Manage Third-Party App Access
  3. Add Ledly as a trusted app (using the Client ID)

Pre-approving the App

To prevent users from seeing a consent screen:

  1. In Admin Console, go to Security → API controls
  2. Click Manage Third-Party App Access
  3. Click Configure new app → OAuth App Name Or Client ID
  4. Enter your Ledly OAuth Client ID
  5. Select your Ledly app
  6. Set access to Trusted

Troubleshooting

”Access Blocked: App not verified” Error

Possible causes:

  • OAuth consent screen is set to External and not verified

Solutions:

  1. For internal use only: Change to Internal user type
  2. For external use: Submit app for Google verification
  3. For testing: Add users to the test users list

”Invalid Client ID” Error

Possible causes:

  • Client ID was not copied correctly
  • OAuth client was deleted

Solutions:

  1. Verify the Client ID in Google Cloud Console matches Ledly
  2. Check that the OAuth client still exists

”Redirect URI Mismatch” Error

Possible causes:

  • Redirect URI doesn’t match exactly

Solution: Verify the authorized redirect URI in Google Cloud Console is exactly:

https://ledlyv2-production.up.railway.app/api/sso/google/callback

Check for:

  • Trailing slashes (there should be none)
  • HTTP vs HTTPS (must be HTTPS)
  • Typos

”Access Denied” Error

Possible causes:

  • User is not in Google Workspace organization (for Internal apps)
  • User declined consent
  • Google Workspace admin blocked the app

Solutions:

  1. Verify the user is a member of your Google Workspace
  2. Have user try again and accept consent
  3. Check Google Workspace admin settings for app restrictions

”OAuth consent screen not configured”

Possible causes:

  • OAuth consent screen was never set up

Solution:

  1. Go to APIs & Services → OAuth consent screen
  2. Complete the consent screen configuration
  3. Try creating the OAuth client again

Revoking SSO Access

Remove User Access (Individual)

Users can revoke Ledly’s access to their Google account:

  1. Go to myaccount.google.com/permissions
  2. Find Ledly in the list
  3. Click Remove Access

Remove Access via Google Workspace Admin

  1. Go to admin.google.com
  2. Navigate to Security → API controls → Manage Third-Party App Access
  3. Find Ledly and change access to Blocked

Disable SSO Integration

To disable SSO for your entire organization:

In Ledly:

  1. Go to Settings → SSO
  2. Toggle off the SSO configuration or select “None” as provider

In Google (optional):

  1. Go to APIs & Services → Credentials
  2. Find your Ledly OAuth client
  3. Click the delete icon to remove it

Support

If you need help with Google Workspace SSO setup:

When contacting support, include:

  • Your Ledly organization ID
  • Your Google Cloud project ID
  • Any error messages displayed
  • Screenshots of your Google configuration (redact secrets)
Azure AD (OIDC)Auth0 (OIDC)