Google Workspace SSO setup #

Connect Google Workspace to eCardWidget over OpenID Connect.

Prerequisites: Enterprise plan; you'll verify your email domain via DNS during setup.

1. Create OAuth 2.0 credentials in Google Cloud #

1. Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth client ID.
2. Application type: Web application.
3. Name: eCardWidget.
4. Authorized JavaScript origins: https://app.ecardwidget.com.
5. Authorized redirect URIs:

   https://app.ecardwidget.com/v2/api/sso/callback
   

6. Create, then copy the Client ID and Client Secret.

2. Configure the consent screen #

1. APIs & Services → OAuth consent screen.
2. User type: Internal (restricts to your Workspace domain).
3. Authorized domains: add ecardwidget.com.
4. Scopes: openid, email, profile.
5. Save.

3. Connect Google Workspace in ECW #

1. Sign in as the account owner → Settings → SSO & Directory Sync → Set up SSO.
2. Provider: choose Google Workspace → Continue.
3. Fill in:
   • Provider name: Google Workspace
   • Email domain: yourcompany.com
   • OIDC discovery URL:

     https://accounts.google.com/.well-known/openid-configuration
     

   • OIDC client ID / client secret: from step 1
4. Click Save & Create SSO.

4. Verify your email domain #

Click Verify Domain, then publish the DNS record:

Wait 5–15 min → Check Now. SSO login is inactive until it shows Verified.

5. Test and sign in #

1. Test Connection — confirm the checks pass.
2. In a fresh incognito window: https://app.ecardwidget.com/main/login → enter a test user's email → Continue with SSO → authenticate with Google → land in the ECW dashboard.

6. (Optional) SCIM provisioning from Google #

If you provision via a SCIM 2.0 connector, use ECW's SCIM Users Endpoint URL (the full endpoint, with /Users):

https://app.ecardwidget.com/v2/api/scim/v2/Users

See SCIM provisioning & attribute mapping for tokens, mappings, and the lifecycle.

Troubleshooting (Google) #

More: Troubleshooting.