SSO with Google Workspace
Sign in with Google today, or set up Google Workspace SSO for your whole domain.
Two ways to use Google
| Continue with Google | Google Workspace SSO | |
|---|---|---|
| Setup | None. The button is on the Rilla sign-in page today. | An OAuth client in your Google Cloud project, then a call with Rilla. |
| Who can use it | Anyone who already has a Rilla account under that Google email. | Everyone on your Workspace domain. New people get an account on first sign-in. |
| Other sign-in methods | Still work. Google is one more way into the same account. | Turned off for your domain. Rilla sends your domain to Google every time. |
Continue with Google links the Google identity to the Rilla account that owns the same email the first time it's used, on web, mobile and desktop. Google must report the email as verified, and the person must already have a Rilla account.
The rest of this page is for Google Workspace SSO. Rilla uses Auth0 for authentication and connects to Google Workspace through OpenID Connect, the same way as Microsoft Entra ID.
Before the call
| What | Details |
|---|---|
| Workspace domain | Your primary Google Workspace domain, such as yourcompany.com, plus any secondary domains or aliases people sign in with. |
| Google Cloud access | Someone who can create an OAuth client in a Google Cloud project that belongs to your organization. |
| An OAuth client | Created in that project with the values below. |
| A Workspace administrator | A super admin who can approve the connection when Auth0 asks for administrator consent, during or after the call. |
Rilla only reads the email, first name and last name Google sends at sign-in. Auth0 still asks a Workspace administrator to approve the connection once.
Create an OAuth client
In the Google Cloud console, open Google Auth Platform for a project in your organization. Register the app if the console asks you to, then:
| Where | What to set |
|---|---|
| Audience | User type: Internal, so only members of your Workspace can sign in and no app verification is needed. |
| Branding | App name Rilla and a support email. If the console asks for Authorized domains, add rilla.com: the sign-in page runs on login.rilla.com. |
| APIs & Services → Library | Enable the Admin SDK API. Auth0 requires it for Google Workspace domains. |
| Clients → Create client | Type Web application. Authorized JavaScript origin https://login.rilla.com. Authorized redirect URI https://login.rilla.com/login/callback, exactly as written. |
Copy the Client ID and the Client secret when the client is created. Google shows the full secret only once.
What we do on the call
Together with Rilla, we will:
- Create the Google Workspace connection in Auth0 with your domain, client ID and client secret
- Route your email domains to Google and enable it for Rilla
- Have your Workspace administrator approve the connection from Auth0's consent link
- Test the full sign-in flow with one of your users
- Troubleshoot any access issues
Good to know
- Existing Rilla accounts link to Google by email on their first SSO sign-in. Nothing is lost.
- Anyone on your domain who signs in gets a Sales Rep account. Admins change roles and teams in Rilla afterwards. SCIM provisioning is tested with Entra ID and Okta, not Google Workspace.
- No certificates or SAML metadata are involved.
For the technical details, see Auth0's Google Workspace connection guide.