SSO
Google Workspace
API integration
Ship SSO features without building the integration. Full Google Workspace API access via Proxy, normalized data through Unified APIs, and 20+ MCP-ready tools for AI agents — all extensible to your exact use case.
Talk to us
Use Cases
Why integrate with Google Workspace
Common scenarios for SaaS companies building Google Workspace integrations for their customers.
Automate employee onboarding and offboarding from Google Workspace
SaaS companies can sync user lifecycle events from their customers' Google Workspace directories to automatically provision new accounts and instantly revoke access when employees are suspended or removed — eliminating manual seat management and closing security gaps.
Build org charts and reporting structures without a standalone HRIS
Many SMB and mid-market customers don't have a dedicated HRIS. By pulling manager, department, and title data from Google Workspace via the Unified HRIS API, SaaS products like performance management or collaboration tools can auto-generate org hierarchies.
Map Google Groups to in-app roles for automatic access control
SaaS companies can let their customers define which Google Workspace Groups correspond to specific product roles or permissions, enabling zero-touch role assignment and ensuring access stays in sync as group memberships change.
Enable enterprise SSO login with Google Workspace
B2B SaaS products need to support 'Sign in with Google' for their customers' employees. Integrating Google Workspace as an SSO provider reduces login friction, enforces centralized MFA policies, and satisfies enterprise security requirements.
Audit SaaS app access against Google Workspace identity data
Spend management and security platforms can reconcile which users have active access to configured SAML/OAuth applications in Google Workspace, helping customers identify unused licenses and shadow IT.
What You Can Build
Ship these features with Truto + Google Workspace
Concrete product features your team can ship faster by leveraging Truto’s Google Workspace integration instead of building from scratch.
Real-time user provisioning from Google Workspace groups
Automatically create or disable accounts in your product when users are added to or removed from specific Google Workspace Groups, with no admin intervention required.
Auto-generated org chart from directory data
Pull employee names, titles, departments, and manager relationships from Google Workspace to build and continuously sync an organizational hierarchy inside your app.
Group-to-role mapping engine
Let customers configure rules that map their Google Workspace Groups or Organizational Units to your product's internal roles and permission levels.
Instant access revocation on employee offboarding
Detect when a user is suspended or deleted in Google Workspace and immediately invalidate their sessions and reassign their assets within your application.
SSO app usage and license reconciliation dashboard
Surface which third-party apps are configured in a customer's Google Workspace and which users have access, enabling license optimization and shadow IT detection.
Department-based ticket and workflow routing
Use Google Workspace group memberships and department data to automatically route tickets, approvals, or tasks to the correct internal queue when a user logs in via SSO.
SuperAI
Google Workspace AI agent tools
Comprehensive AI agent toolset with fine-grained control. Integrates with MCP clients like Cursor and Claude, or frameworks like LangChain.
list_all_admin_users
List all Google Workspace users in the directory. Returns a collection of user objects including id, primaryEmail, and name.
get_single_admin_user_by_id
Get a single Google Workspace user by id. Returns the full user object including id, primaryEmail, name, and associated account details. Required: id.
create_a_admin_user
Create a new Google Workspace user in the directory. Returns the created user object including id and primaryEmail. Required: primaryEmail, name (givenName and familyName), and password.
update_a_admin_user_by_id
Update an existing Google Workspace user by id, replacing the resource with the supplied fields. Returns the updated user object including id and primaryEmail. Required: id.
delete_a_admin_user_by_id
Delete a Google Workspace user by id. Returns an empty 204 response on success. Required: id.
list_all_admin_groups
List groups in the Google Directory. Returns an array of group objects for the customer.
get_single_admin_group_by_id
Get a single Google Directory group by id. Returns the full group object. Required: id.
list_all_admin_group_members
List all members of a Google group. Returns member records for the specified group. Required: group_id.
get_single_admin_group_member_by_id
Get a single member of a Google group by id. Returns the member record for the specified group and member. Required: group_id, id.
create_a_admin_group_member
Add a new member to a Google group. Returns the created member record. Required: group_id.
update_a_admin_group_member_by_id
Update an existing member of a Google group by id. Returns the updated member record. Required: group_id, id.
delete_a_admin_group_member_by_id
Remove a member from a Google group by id. Returns an empty response on success. Required: group_id, id.
list_all_oauth_user_info
Retrieves basic profile information about the authenticated user in Google Calendar. The response includes essential details such as the user's unique identifier (sub), full name (name), first name (given_name), last name (family_name), profile picture URL (picture), and email address (email).
get_single_admin_customer_by_id
Get a Google Admin Directory customer by id. Returns the customer object from the Admin Directory API. Required: id.
list_all_admin_licenses
List Google Workspace product licenses assigned to users for a given product. Returns user license assignment records. Required: product_id.
list_all_admin_usage_reports
List Google Admin usage reports for all users on a specific date. Returns usage activity records per user for the given date. Required: date (in YYYY-MM-DD format).
create_a_oauth_token
Exchange an authorization code or refresh token for a Google OAuth access token via the Google OAuth2 token endpoint. Returns: access_token, token_type, expires_in, and optionally refresh_token. Required: grant_type, client_id, client_secret, and either code with redirect_uri (for authorization_code grant) or refresh_token (for refresh_token grant).
list_all_admin_roles
List all roles defined in the Google Admin Directory for the authenticated customer. Returns an array of role objects from the directory.
list_all_admin_role_assignments
List all role assignments for your Google Admin Directory customer account. Returns a collection of role assignment items from the Google Admin SDK.
list_all_admin_tokens
List all OAuth tokens issued by a Google user to third-party applications. Returns a collection of token items associated with the user. Required: user_id.
list_all_admin_org_units
List Google organizational units for the customer. Returns an array of organizationUnits objects from the Google Admin Directory API.
Why Truto
Why use Truto’s MCP server for Google Workspace
Other MCP servers give you a static tool list for one app. Truto gives you a managed, multi-tenant MCP infrastructure across 700+ integrations.
Auto-generated, always up to date
Tools are dynamically generated from curated documentation — not hand-coded. As integrations evolve, tools stay current without manual maintenance.
Fine-grained access control
Scope each MCP server to read-only, write-only, specific methods, or tagged tool groups. Expose only what your AI agent needs — nothing more.
Multi-tenant by design
Each MCP server is scoped to a single connected account with its own credentials. The URL itself is the auth token — no shared secrets, no credential leaking across tenants.
Works with every MCP client
Standard JSON-RPC 2.0 protocol. Paste the URL into Claude, ChatGPT, Cursor, or any MCP-compatible agent framework — tools are discovered automatically.
Built-in auth, rate limits, and error handling
Tool calls execute through Truto’s proxy layer with automatic OAuth refresh, rate-limit handling, and normalized error responses. No raw API plumbing in your agent.
Expiring and auditable servers
Create time-limited MCP servers for contractors or automated workflows. Optional dual-auth requires both the URL and a Truto API token for high-security environments.
Unified APIs
Unified APIs for Google Workspace
Skip writing code for every integration. Use Truto’s category-specific Unified APIs out of the box or customize the mappings with AI.
Unified HRIS API
Unified User Directory API
How It Works
From zero to integrated
Go live with Google Workspace in under an hour. No boilerplate, no maintenance burden.
Link your customer’s Google Workspace account
Use Truto’s frontend SDK to connect your customer’s Google Workspace account. We handle all OAuth and API key flows — you don’t need to create the OAuth app.
We handle authentication
Don’t spend time refreshing access tokens or figuring out secure storage. We handle it and inject credentials into every API request.
Call our API, we call Google Workspace
Truto’s Proxy API is a 1-to-1 mapping of the Google Workspace API. You call us, we call Google Workspace, and pass the response back in the same cycle.
Unified response format
Every response follows a single format across all integrations. We translate Google Workspace’s pagination into unified cursor-based pagination. Data is always in the result attribute.
FAQs
Common questions about Google Workspace on Truto
Authentication, rate limits, data freshness, and everything else you need to know before you integrate.
Which Google Workspace APIs does this integration use?
The integration primarily leverages the Google Admin SDK Directory API for user, group, organizational unit, and role data, as well as Google Identity Services for SSO-related app and app user information.
What authentication method is required to connect a Google Workspace account?
Google Workspace uses OAuth 2.0 for authorization. The customer's Google Workspace admin grants consent with the required admin scopes (e.g., admin.directory.user.readonly, admin.directory.group.readonly) so Truto can access directory and identity data on their behalf.
What Unified APIs does Google Workspace map to in Truto?
Google Workspace maps to the Unified HRIS API (Employees, Groups), the Unified User Directory API (Users, Roles, Role Assignments), and the Unified Single Sign-On API (Apps, App Users). Specific tools are built on request to match your integration needs.
How does Truto handle pagination and rate limits for the Google Admin SDK?
Truto manages pagination tokens and respects Google's per-user and per-domain rate limits automatically, so your application receives complete result sets without needing to implement retry logic or cursor management.
Can I access custom user attributes defined in Google Workspace?
Google Workspace supports custom schemas on user profiles (e.g., cost center, employee ID). Availability of custom fields through Truto depends on your specific requirements — reach out to discuss mapping custom schema attributes to unified models.
Are write operations supported, or is the integration read-only?
The current Unified API models focus on reading identity and directory data from Google Workspace. Write operations such as creating users or modifying group memberships can be scoped and built on request based on your use case.
Google Workspace
Get Google Workspace integrated into your app
Our team understands what it takes to make a Google Workspace integration successful. A short, crisp 30 minute call with folks who understand the problem.