This guide walks you through the complete setup process for integrating Google Workspace with TeamPassword Enterprise for Single Sign-On (SSO) authentication.
Summary of the steps:
Subscribe to an Enterprise plan
Create an OAuth client in Google Cloud Console
Configure Authentication platform
Enable Enterprise SSO
Sign in with Enterprise SSO
Overview
This configuration enables customers to authenticate with TeamPassword using their Google Workspace credentials. Once set up, users can sign in through the Enterprise SSO button without needing to enter their separate TeamPassword email and password.
Note: This integration uses your own dedicated Google OAuth client, restricted to your Workspace domain (Google's "Internal" app type). Only accounts within your own organization can ever use it to sign in, enforced by Google itself.
Note: SAML ≠ SSO.
TeamPassword’s Enterprise SSO integration uses the OpenID Connect (OIDC) protocol, a modern, industry-standard authentication framework. SAML is a different protocol and is not required. To configure Enterprise SSO, customers simply need to create an OIDC application in Google Cloud Console and use those credentials to complete the setup.
Part 1: Subscribe to an Enterprise plan
Enterprise SSO is available to customers subscribed to one of our Enterprise plans.
If you are currently on an active Standard plan, you can upgrade to Enterprise from your team’s Billing page.
If you are on a legacy bulk plan and do not see the option to upgrade to Enterprise, please contact [email protected] for assistance.
Part 2: Google Cloud Configuration
Prerequisites
To configure Enterprise SSO with TeamPassword using Google Workspace as your identity provider, customers must have:
An active Google Workspace account
Your team must have an existing Google Workspace (or Cloud Identity) account with a verified domain. This is required to manage users and to create an internal OAuth client. You can sign in to the Google Cloud Console with your Workspace admin account. No paid Google Cloud subscription or billing setup is required.Administrative access to Google Cloud Console
The person performing the setup must have sufficient permissions (e.g., Organization Administrator, or a role such as Project Creator or Owner on the project) to create a project, configure the OAuth consent screen, and create OAuth clients.Ability to create an OAuth client (OpenID Connect)
TeamPassword’s SSO integration uses the OpenID Connect (OIDC) protocol. During setup, you will need to:Create a Google Cloud project (or select an existing one)
Configure the OAuth consent screen with the user type set to Internal
Create an OAuth client ID (application type: Web application)
Configure redirect (callback) URLs
Copy the Client ID and Client Secret
Users provisioned in Google Workspace
Users who need access to TeamPassword must already exist in your Google Workspace organization.
Step 1: Provision Users
Sign in to the Google Cloud Console.
Verify that your users are properly configured. Users must have a one-to-one mapping with their TeamPassword accounts — the email address in Google Workspace must exactly match the email address associated with their TeamPassword account.
Step 2: Create a Google Cloud Project
Sign in to the Google Cloud Console.
Create a new project (or select an existing one dedicated to this integration).
Step 3: Configure the OAuth Consent Screen
In your project, go to Google Auth Platform, and click Get started.
Fill in App Information: App name (e.g. "TeamPassword SSO"), and a support email.
Under Audience, select Internal — this restricts sign-in to accounts within your own Workspace organization only.
Complete the remaining branding/contact information steps and finish setup.
Step 4: Create OAuth Client Credentials
Go to Clients, click Create client.
Configure the client with the following settings:
Application type: Web application
Name: TeamPassword SSO
Authorized redirect URI:
https://teampassword.fusionauth.io/oauth2/callback
Click Create.
Note the Client ID and Client secret shown — you'll need both in the next step.
⚠️ Important: This secret value will only be displayed once. Copy it now and store it securely.
Step 5: Save Credentials
To make things easier in the next step, save the above credentials in a record.
In your TeamPassword account, create a record named:
Enterprise SSO Setup Credentials – <your-team-name>
⚠️ Important: Be sure to include your team/organization name in the record title.Copy and paste the following into the notes section, replacing the values with your actual values:
These are our Enterprise SSO setup credentials to be shared with the TeamPassword support team. Please do not delete this record until Enterprise SSO migration is complete.
Client ID: <your Client ID>
Client secret: <your Client Secret>Click Save
Part 3: Authentication Platform Configuration
Using the Google Workspace credentials collected in the previous step, our team will now need to complete the remaining configuration in our authentication platform.
Step 1: Share credentials with TeamPassword Support
Please contact TeamPassword Support at [email protected] to inform us that you have completed your Google Workspace setup and have the credentials ready to share.
Once we have confirmed your email, create a one-time share of the credentials record you just created and send the link to [email protected]. Set expiration to at least 3 days, so we have we have enough time to look out for it.
Note: The Allow one-time secret links feature must be enabled in the security settings in order to be able to share shared records. Private records can always be shared.
Step 2: Await confirmation from TeamPassword Support
Once we receive your credentials, we will finish Enterprise SSO configuration in our authentication platform and contact you once complete.
Part 4: Enable Enterprise SSO
Once configuration is complete, finalize the setup by enabling Enterprise SSO from within TeamPassword.
Step 1: Owner migration
The team owner must first enable Enterprise SSO for their own account from their Account Settings > Sign-in Methods page.
Step 2: Member migration
Once the owner has enabled Enterprise SSO, the rest of the team members will be able to enable it for their own accounts by following the same steps. Because users can belong to multiple teams but can only be associated with one Enterprise SSO–enabled team at a time, Enterprise SSO must be enabled individually by each user.
Part 5: Sign in with Enterprise SSO
With all steps complete, you can now sign in using Enterprise SSO from your new workspace URL. We recommend bookmarking this URL for easy access in the future.
Alternatively, you can sign in from the standard sign-in page by clicking the Enterprise SSO button. You will be prompted to enter your workspace subdomain before being redirected to sign in.
