> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gavai.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO — Google Workspace

> Configure SAML SSO between Google Workspace and gavAI

This page walks the Google Workspace-side setup. The gavAI-side counterpart is the wizard at `/console/settings/sso/new/google`.

## Prerequisites

* Google Workspace **Super Admin** access.
* Workspace admin in gavAI on a Scale or Enterprise plan.
* One or more email domains you control.

## 1. Create the SAML app

1. Google Admin Console → **Apps → Web and mobile apps → Add app → Add custom SAML app**.
2. **App name**: `gavAI`.
3. On the **Google IdP details** step, **download the IdP metadata XML** — you'll either paste its URL into gavAI, or self-host the XML at a stable URL.

## 2. Configure service provider details

Use these values from the gavAI wizard at `/console/settings/sso/new/google`:

* **ACS URL**: from the wizard.
* **Entity ID**: from the wizard.
* **Name ID format**: `EMAIL`.
* **Name ID**: `Primary email`.

## 3. Attribute mapping

Add at minimum:

* `email` → `Primary email`
* `firstName` → `First name`
* `lastName` → `Last name`

## 4. Turn on the app

Back in the app config, scroll to **User access** → **ON for everyone** (or scope to an organisational unit).

## 5. Hand metadata back to gavAI

Provide the IdP metadata to gavAI:

* If Google gave you a hosted metadata URL, paste it into the gavAI wizard.
* Otherwise host the XML at a stable URL on your side and paste that.

## 6. Verify domains and test

Add the TXT record gavAI shows, then sign in at `https://gavai.io/login`.

## Optional: SCIM provisioning

Pair SSO with [SCIM](/integrations/scim) for automated user lifecycle.