> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/pre-built-integrations/g-suite.md).

# G-Suite

***

### Prerequisites

Before starting, make sure you have:

* **AdminX portal** — Admin access to your 1Kosmos AdminX tenant. 
* **Google Cloud Platform (GCP)** — Admin access to create projects and service accounts.
* **Google Admin Console** — Admin access to configure domain-wide delegation and SSO settings.
* **1Kosmos mobile app** — Installed and enrolled on iOS or Android. ([Android](https://play.google.com/store) · [iOS](https://apps.apple.com/))
  * Biometrics (Touch ID / Face ID or LiveID) must be enrolled before testing.

***

### Step 1 — Create a GCP Service Account

{% hint style="info" %}
**Note:** These steps are performed by your Google Cloud administrator.
{% endhint %}

1. Sign in to your [Google Cloud Platform console](https://console.cloud.google.com/).
2. Click the project dropdown next to the **Google Cloud Platform** heading and select **NEW PROJECT**.
3. Enter a **Project Name**, select your **Organization** and **Location**, then click **Create**.
4. Once created, select the new project from the Notifications panel.
5. Go to **Navigation menu → IAM & Admin → Service Accounts**.
6. Click **Create Service Account**, enter a name and description, then click **Done**.
7. Click on the newly created service account and copy and save the **Email** and **Unique ID** — you'll need both in AdminX.

***

### Step 2 — Add Domain-Wide Delegation

{% hint style="info" %}
**Note:** These steps are performed by your Google Admin Console administrator.
{% endhint %}

1. Sign in to your [Google Admin Console](https://admin.google.com/).
2. Go to **Security → API Controls → Manage Domain Wide Delegation**.
3. Click **Add new** and enter the following:

   | Field        | Value                                                   |
   | ------------ | ------------------------------------------------------- |
   | Client ID    | The **Unique ID** of your service account (from Step 1) |
   | OAuth Scopes | `https://apps-apis.google.com/a/feeds/domain/`          |
4. Click **Authorize**.

***

### Step 3 — Generate a Private Key for the Service Account

{% hint style="info" %}
**Note:** These steps are performed by your Google Cloud administrator.
{% endhint %}

1. In GCP, go to **IAM & Admin → Service Accounts** and open your service account.
2. Click the **Keys** tab → **Add Key → Create new key**.
3. Select **JSON** as the key type and click **Create**. The key file downloads automatically.
4. Open the JSON file and save the private key value — you'll need it in AdminX.

***

### Step 4 — Connect Google Workspace in AdminX

{% hint style="info" %}
**Note:** These steps are performed by your AdminX administrator.
{% endhint %}

1. Sign in to the AdminX portal and go to **Applications → Add Application**.
2. Under **Pre-built integrations**, click **Add Integration** on the **Google Workspace** card.
3. Fill in the following fields:

   | Field                       | Value                                                                      |
   | --------------------------- | -------------------------------------------------------------------------- |
   | Application Name            | A display name for this integration                                        |
   | Google Workspace Domain     | Your domain without `http://` or `https://` (e.g., `yourorganization.org`) |
   | Service Account Email       | The service account email saved in Step 1                                  |
   | Admin Email                 | The GCP admin Gmail address used to create the project                     |
   | Service Account Private Key | The private key value from the JSON file in Step 3                         |
4. Click **Connect**.

AdminX automatically generates the SAML SP configuration in Google Workspace and enables the integration.

***

### Step 5 — Export the IDP Signing Certificate from AdminX

1. In the AdminX portal, go to **Settings → IDP Configuration**.
2. Copy the certificate from the **Signing Certificate** section.
3. Save it as a `.cert` file — you'll upload this to Google Admin Console in the next step.

***

### Step 6 — Configure SSO in Google Admin Console

{% hint style="info" %}
**Note:** These steps are performed by your Google Admin Console administrator.
{% endhint %}

1. Sign in to your [Google Admin Console](https://admin.google.com/).
2. Go to **Security → Settings** and click **Set up single sign-on (SSO) with a third party IdP**.
3. Enter the SSO details generated by AdminX:
   * **Sign-on Page URL** — from AdminX IDP Configuration
   * **Sign-out Page URL** — from AdminX IDP Configuration
   * **Verification certificate** — upload the `.cert` file exported in Step 5
4. Save your settings.

***

### Step 7 — Test the Connection

{% hint style="info" %}
**Note:** These steps should be performed by a Google Workspace domain user.
{% endhint %}

1. Open a browser and go to your Google Workspace domain URL.
2. You'll be redirected to the 1Kosmos AdminX login screen with a QR code.
3. On the 1Kosmos mobile app home screen, tap **Scan QR**.
4. Scan the QR code. When prompted, select **Allow only while using the app**.
5. Tap **Authenticate** and complete biometric verification (Touch ID, Face ID, or LiveID).
6. On success, you'll be logged in to your Google Workspace account.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/integrations/authentication/pre-built-integrations/g-suite.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.