Google Workspace
Connect Google Workspace to nano with OIDC using a Google Cloud OAuth 2.0 client.
Google Workspace (OIDC)
Google Workspace's admin console (Web and mobile apps → Add custom app) only offers SAML for custom apps. nano uses OIDC, so you do not use that page. Instead you create an OAuth 2.0 client in the Google Cloud Console — Google is a first-class OIDC provider at https://accounts.google.com.
Prerequisites
- A Google Cloud project in the same organization as your Workspace.
- Access to the Google Cloud Console (
console.cloud.google.com) and permission to create OAuth clients. - Your nano host and a chosen provider slug (this guide uses
google).
Steps
Select or create a Google Cloud project in your Workspace organization at console.cloud.google.com.
Configure the OAuth consent screen. Go to APIs & Services → OAuth consent screen. Set User Type to Internal — this restricts sign-in to accounts in your Workspace domain. Fill in the app name and support email, then save.
Create the OAuth client. Go to APIs & Services → Credentials → Create Credentials → OAuth client ID. Choose Application type: Web application. Under Authorized redirect URIs, add:
https://<your-nano-host>/auth/callback/googleClick Create.
Copy the credentials. Google shows your Client ID and Client secret — keep them for the next step.
Add the provider in nano. Go to Settings → Single Sign-On → Add provider and enter:
| Field | Value |
|---|---|
| Name | Google Workspace |
| Slug | google |
| Issuer URL | https://accounts.google.com |
| Client ID | (from Google) |
| Client Secret | (from Google) |
| Scopes | openid email profile |
Save.
Test it. Sign out, then use Sign in with Google Workspace on the login page. The first successful login provisions your nano account.
Group mapping
Google does not include group memberships in the standard OIDC ID token, so nano's group-claim mapping does not work with Google out of the box. Assign roles to Google SSO users directly in nano, or synchronize groups through a separate Google Cloud Identity / directory integration.
Troubleshooting
redirect_uri_mismatch— the Authorized redirect URI in the Google OAuth client must matchhttps://<your-nano-host>/auth/callback/googleexactly, including thegoogleslug.- "Access blocked" / user not from your org — the consent screen must be Internal, and the user must belong to your Workspace domain.