SSO — Google Workspace

This page walks the Google Workspace-side setup. The gavAI-side counterpart is the wizard at /console/settings/sso/new/google.

​

Prerequisites

• Google Workspace Super Admin access.
• Workspace admin in gavAI on a Scale or Enterprise plan.
• One or more email domains you control.

​

1. Create the SAML app

1. Google Admin Console → Apps → Web and mobile apps → Add app → Add custom SAML app.
2. App name: gavAI.
3. On the Google IdP details step, download the IdP metadata XML — you’ll either paste its URL into gavAI, or self-host the XML at a stable URL.

​

2. Configure service provider details

Use these values from the gavAI wizard at /console/settings/sso/new/google:

• ACS URL: from the wizard.
• Entity ID: from the wizard.
• Name ID format: EMAIL.
• Name ID: Primary email.

​

3. Attribute mapping

Add at minimum:

• email → Primary email
• firstName → First name
• lastName → Last name

​

4. Turn on the app

Back in the app config, scroll to User access → ON for everyone (or scope to an organisational unit).

​

5. Hand metadata back to gavAI

Provide the IdP metadata to gavAI:

• If Google gave you a hosted metadata URL, paste it into the gavAI wizard.
• Otherwise host the XML at a stable URL on your side and paste that.

​

6. Verify domains and test

Add the TXT record gavAI shows, then sign in at https://gavai.io/login.

​

Optional: SCIM provisioning

Pair SSO with SCIM for automated user lifecycle.