Set up per workspace, on a paid plan

Your Google OAuth client ID identifies your app to Google. Register it in the workspace's Tenant Settings → SSO (choose Google). nostackai accepts a Google sign-in only when the token was issued to a client ID one of your org's workspaces registered, so a token Google issued to some other app is refused.

Get a Google OAuth client ID

1In the Google Cloud Console, create (or reuse) a project and open APIs & Services → OAuth consent screen. Choose Internal if only your Google Workspace users will sign in.
2Open Credentials and create an OAuth client ID of type "Web application".
3Add every origin your app is served from (including localhost during development) under Authorized JavaScript origins.
4Copy the client ID. There is no client secret to store; the browser flow never uses one.

Register it in nostackai

1Open the workspace in the console, then Tenant Settings → SSO, and choose Google.
2Paste the Google client ID.
3Enter a sign-in domain (for example acme.com) if people sign in with a Google Workspace company email. A domain belongs to exactly one workspace of the org. For personal Google accounts (gmail.com), use the Personal Google accounts (Gmail) card on the same screen instead: enter the client ID your app's Google button uses and choose whether a new person stays pending or is approved with the workspace's default ACL. People who sign in with Gmail through that client ID join this workspace. If your app has one sign-in page for every customer, register its client ID on the workspace new Gmail users should land in; a customer with its own page can register its own client ID on its own workspace. One client ID belongs to one workspace.
4Make sure your org's Allowed Domains lists your app's origin, then save.

The two ways a user signs in with Google

  • Plain Google account (a personal gmail.com or googlemail.com address) — your app starts Google sign-in with the client ID it was configured with, then sends the Google ID token to the token endpoint. No lookup is needed. If a workspace registered that client ID under Personal Google accounts (Gmail), the person joins that workspace; otherwise they follow your org's usual rule for new users (the default workspace, or none until they join one in a multi-workspace org).
  • Company email (Google Workspace) — your app asks for the work email and calls POST /app/{orgCode}/ssoconfig with client_id in the header and { "email": "..." } in the body. The email's domain finds the workspace and the answer is { "provider": "google", "client_id": "..." }. Your app then starts Google sign-in with that client ID (Google's own button, no redirect).

Either way the Google ID token goes to the same endpoint:

http 
GET /app/{orgCode}/token
  oauthtoken: <google id_token>
  client_id: <your app client id>

-> 200, header  x-nostackai-token: <app JWT>

What is verified

The token's signature is checked against Google's published keys and the email must be verified by Google. The email's domain decides the client ID: a domain a workspace claimed must use that workspace's client ID, a gmail.com or googlemail.com address must use a client ID a workspace of your org registered, and any other domain is refused. An org with no workspace that registered a Google client ID cannot sign in with Google.

How the user record is created

There's no separate sign-up step. The first time a given Google account calls the token endpoint, nostackai reads the email, name and picture off the ID token and creates the account inline, skipping only the password. Later sign-ins resolve to the same record.

  • Single-tenancy org — the new account joins the org's one workspace and is immediately usable.
  • Multi-tenancy org, first sign-in — the account is created but has no workspace. Your app prompts the user to create or join one before anything workspace-scoped works — see App user authentication.

Test it in the playground

Drive a real Google sign-in without writing any code.

SSO overview

Console SSO vs workspace SSO.