> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/pre-built-integrations/g-suite.md).

# G-Suite

Enable passwordless, biometric login for your Google Workspace users using 1K as a SAML 2.0 Identity Provider. Once connected, users authenticate with Touch ID, Face ID, or LiveID.

***

### Prerequisites

Before starting, make sure you have:

* **AdminX portal** — Admin access to your 1Kosmos AdminX tenant. 
* **Google Cloud Platform (GCP)** — Admin access to create projects and service accounts.
* **Google Admin Console** — Admin access to configure domain-wide delegation and SSO settings.
* **1Kosmos mobile app** — Installed and enrolled on iOS or Android. ([Android](https://play.google.com/store) · [iOS](https://apps.apple.com/))
  * Biometrics (Touch ID / Face ID or LiveID) must be enrolled before testing.

***

### Step 1 — Create a GCP Service Account

{% hint style="info" %}
**Note:** These steps are performed by your Google Cloud administrator.
{% endhint %}

1. Sign in to your [Google Cloud Platform console](https://console.cloud.google.com/).
2. Click the project dropdown next to the **Google Cloud Platform** heading and select **NEW PROJECT**.
3. Enter a **Project Name**, select your **Organization** and **Location**, then click **Create**.
4. Once created, select the new project from the Notifications panel.
5. Go to **Navigation menu → IAM & Admin → Service Accounts**.
6. Click **Create Service Account**, enter a name and description, then click **Done**.
7. Click on the newly created service account and copy and save the **Email** and **Unique ID** — you'll need both in AdminX.

***

### Step 2 — Add Domain-Wide Delegation

{% hint style="info" %}
**Note:** These steps are performed by your Google Admin Console administrator.
{% endhint %}

1. Sign in to your [Google Admin Console](https://admin.google.com/).
2. Go to **Security → API Controls → Manage Domain Wide Delegation**.
3. Click **Add new** and enter the following:

   | Field        | Value                                                   |
   | ------------ | ------------------------------------------------------- |
   | Client ID    | The **Unique ID** of your service account (from Step 1) |
   | OAuth Scopes | `https://apps-apis.google.com/a/feeds/domain/`          |
4. Click **Authorize**.

***

### Step 3 — Generate a Private Key for the Service Account

{% hint style="info" %}
**Note:** These steps are performed by your Google Cloud administrator.
{% endhint %}

1. In GCP, go to **IAM & Admin → Service Accounts** and open your service account.
2. Click the **Keys** tab → **Add Key → Create new key**.
3. Select **JSON** as the key type and click **Create**. The key file downloads automatically.
4. Open the JSON file and save the private key value — you'll need it in AdminX.

***

### Step 4 — Connect Google Workspace in AdminX

{% hint style="info" %}
**Note:** These steps are performed by your AdminX administrator.
{% endhint %}

1. Sign in to the AdminX portal and go to **Applications → Add Application**.
2. Under **Pre-built integrations**, click **Add Integration** on the **Google Workspace** card.
3. Fill in the following fields:

   | Field                       | Value                                                                      |
   | --------------------------- | -------------------------------------------------------------------------- |
   | Application Name            | A display name for this integration                                        |
   | Google Workspace Domain     | Your domain without `http://` or `https://` (e.g., `yourorganization.org`) |
   | Service Account Email       | The service account email saved in Step 1                                  |
   | Admin Email                 | The GCP admin Gmail address used to create the project                     |
   | Service Account Private Key | The private key value from the JSON file in Step 3                         |
4. Click **Connect**.

AdminX automatically generates the SAML SP configuration in Google Workspace and enables the integration.

***

### Step 5 — Export the IDP Signing Certificate from AdminX

1. In the AdminX portal, go to **Settings → IDP Configuration**.
2. Copy the certificate from the **Signing Certificate** section.
3. Save it as a `.cert` file — you'll upload this to Google Admin Console in the next step.

***

### Step 6 — Configure SSO in Google Admin Console

{% hint style="info" %}
**Note:** These steps are performed by your Google Admin Console administrator.
{% endhint %}

1. Sign in to your [Google Admin Console](https://admin.google.com/).
2. Go to **Security → Settings** and click **Set up single sign-on (SSO) with a third party IdP**.
3. Enter the SSO details generated by AdminX:
   * **Sign-on Page URL** — from AdminX IDP Configuration
   * **Sign-out Page URL** — from AdminX IDP Configuration
   * **Verification certificate** — upload the `.cert` file exported in Step 5
4. Save your settings.

***

### Step 7 — Test the Connection

{% hint style="info" %}
**Note:** These steps should be performed by a Google Workspace domain user.
{% endhint %}

1. Open a browser and go to your Google Workspace domain URL.
2. You'll be redirected to the 1Kosmos AdminX login screen with a QR code.
3. On the 1Kosmos mobile app home screen, tap **Scan QR**.
4. Scan the QR code. When prompted, select **Allow only while using the app**.
5. Tap **Authenticate** and complete biometric verification (Touch ID, Face ID, or LiveID).
6. On success, you'll be logged in to your Google Workspace account.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.1kosmos.com/integrations/authentication/pre-built-integrations/g-suite.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.