How do I set up SSO with Google Workspace?

Connect Google Workspace so your team signs in to Squeezle with their Google accounts. Workspace's built-in path is a custom SAML app; you can also use Google as an OIDC provider. Do this as a Squeezle owner or admin under Admin → Authentication & SSO; in Google you need super administrator access.

Option A — SAML (recommended for Workspace)

1. In Squeezle, open Admin → Authentication & SSO, set Provider to SAML 2.0, and keep the tab open. You will copy two read-only URLs from it:
   • ACS (Assertion Consumer Service) URL — https://api.squeezle.app/auth/sso/<org-slug>/saml/acs
   • SP metadata URL — https://api.squeezle.app/auth/sso/<org-slug>/saml/metadata
2. In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app. Name it "Squeezle" and continue.
3. On Google Identity Provider details, copy the SSO URL and the Entity ID, and download the Certificate. Continue.
4. On Service provider details, enter:
   • ACS URL — the Squeezle ACS URL from step 1.
   • Entity ID — the Squeezle SP metadata URL from step 1. You will paste this same value into Squeezle's SP entity ID.
   • Name ID format — EMAIL.
   • Name ID — Basic Information → Primary email.
5. On Attributes, add one mapping: Primary email → app attribute email. Finish.
6. Back in Squeezle, fill in the Identity provider fields:
   • IdP SSO URL — Google's SSO URL from step 3.
   • IdP signing certificate (PEM or base64) — the certificate from step 3.
   • SP entity ID — the same SP metadata URL you used as Google's Entity ID in step 4. Set it explicitly; do not leave it blank.
   • Leave IdP metadata XML (optional) empty.
7. Add your domains in Verified email domains (for example example.com), turn on Enable SSO sign-in, and click Save configuration.
8. In the Google Admin console, turn the app ON for everyone (or for the right org unit) under User access.

Attribute / claim mapping

• email → Google Primary email, sent as the SAML NameID (EMAIL) and as an attribute named email.
• name, groups → not used by Squeezle.

Verify it works

Squeezle's SAML is identity-provider-initiated, so launch from Google: open the app tile at myapps.google.com (or the Google app launcher) and click Squeezle. You should land signed in. If you see a sign-in error, confirm the user is already invited to the org, their email domain is listed in Verified email domains, and Google's Entity ID exactly equals Squeezle's SP entity ID.

Option B — OIDC

Use this if you would rather run OIDC. You create an OAuth client in Google Cloud, and members can start sign-in from the Squeezle page.

1. In Squeezle, set Provider to OpenID Connect and copy the read-only Redirect / callback URL — https://api.squeezle.app/auth/sso/<org-slug>/oidc/callback.
2. In the Google Cloud console, in a project in your Workspace organization, open APIs & Services → OAuth consent screen and set the user type to Internal so only your Workspace can use it.
3. Open Credentials → Create credentials → OAuth client ID, choose application type Web application, and under Authorised redirect URIs add the Squeezle callback URL from step 1. Create it.
4. Copy the Client ID and Client secret.
5. Back in Squeezle, enter:
   • Issuer — https://accounts.google.com
   • Client ID and Client secret from step 4.
   • Leave Discovery URL (optional) empty. Squeezle reads https://accounts.google.com/.well-known/openid-configuration from the issuer.
   • Scopes — keep the default openid email profile.
6. Add your domains in Verified email domains, turn on Enable SSO sign-in, and click Save configuration.

Attribute / claim mapping

• email → the email claim. Google marks Workspace emails verified, which Squeezle requires.
• Squeezle keys the identity on the sub claim; name and groups are not used.

Verify it works

On the Squeezle sign-in page, start SSO for your organization; you are sent to Google and back. If linking fails, check that the user is invited and their domain is in Verified email domains.

Then roll out and enforce as in Set up SSO.