Google Workspace SSO setup #

Connect Google Workspace to eCardWidget over OpenID Connect.

Prerequisites: Enterprise plan; you'll verify your email domain via DNS during setup.

1. Create OAuth 2.0 credentials in Google Cloud #

1. Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth client ID.
2. Application type: Web application.
3. Name: eCardWidget.
4. Authorized JavaScript origins: https://app.ecardwidget.com.
5. Authorized redirect URIs — add both:

   https://app.ecardwidget.com/v2/api/sso/callback
   https://app.ecardwidget.com/v2/api/pub/sender/ssoCallback
   

   The first is dashboard (admin) sign-in; the second is SSO sign-in inside the eCard widget (sender verification / team-directory sending) — without it, widget sign-in fails with redirect_uri_mismatch.
6. Create, then copy the Client ID and Client Secret.

2. Configure the consent screen #

1. APIs & Services → OAuth consent screen.
2. User type: Internal (restricts to your Workspace domain).
3. Authorized domains: add ecardwidget.com.
4. Scopes: openid, email, profile.
5. Save.

3. Connect Google Workspace in ECW #

1. Sign in as the account owner → Settings → SSO & Directory Sync → Set up SSO.
2. Provider: choose Google Workspace → Continue.
3. Fill in:
   • Provider name: Google Workspace
   • Email domain: yourcompany.com
   • OIDC discovery URL:

     https://accounts.google.com/.well-known/openid-configuration
     

   • OIDC client ID / client secret: from step 1
4. Click Save & Create SSO.

4. Verify your email domain #

Click Verify Domain, then publish the DNS record:

Record name	Type	Value
_ecw-domain-verify.yourcompany.com	TXT	ecw-domain-verify=<token>

Wait 5–15 min → Check Now. SSO login is inactive until it shows Verified.

If the domain still isn't verified after waiting, DNS changes can take longer to propagate — give it up to an hour and click Check Now again. If it still won't verify, email [email protected] and we'll help you check the record.

5. Enable SSO, then test and sign in #

1. Turn on SSO. In Settings → SSO & Directory Sync, toggle Enable SSO — verifying the domain does not switch login on by itself. (Enabling may ask for an admin OTP.)
2. Test Connection — confirm the checks pass.
3. In a fresh incognito window: https://app.ecardwidget.com/main/login → enter a test user's email → Continue with SSO → authenticate with Google → land in the ECW dashboard.

6. (Optional) SCIM provisioning from Google #

If you provision via a SCIM 2.0 connector, use ECW's SCIM Users Endpoint URL (the full endpoint, with /Users):

https://app.ecardwidget.com/v2/api/scim/v2/Users

See SCIM provisioning & attribute mapping for tokens, mappings, and the lifecycle.

Troubleshooting (Google) #

Symptom	Fix
redirect_uri_mismatch	The redirect URI in Google Cloud ≠ what ECW sent. Match both ends exactly.
403 access_denied on consent	User isn't in your Workspace domain (consent screen is Internal). Ensure they have a @yourcompany.com Google account.
sso_error=domain_mismatch	Token email isn't on your registered domain. Confirm the user's primary Workspace email.

More: Troubleshooting.