How to Connect Google Workspace to AllowNow

The Google Workspace connector pulls your directory — users, super-admins, and group memberships — into AllowNow on a read-only basis, normalises it to access levels, and flags drift: anyone in Google who isn't documented in AllowNow, and any AllowNow user who has left the directory. Authentication uses a Google Cloud service account with domain-wide delegation. Read-only scopes only — the connector can never change your directory.

Prerequisites

Google Workspace super-admin access to admin.google.com
Access to a Google Cloud project (or permission to create one)
AllowNow owner access — connectors live under Connectors in the sidebar

Create a project and enable the Admin SDK API

5 minutes

In the Google Cloud Console, pick or create a project. Then go to APIs & Services → Library, search for Admin SDK API, and click Enable. This is the API the connector calls to read your directory.

Create a service account and JSON key

5 minutes

APIs & Services → Credentials → Create credentials → Service account. Name it e.g. allownow-connector.
Open the service account → Keys → Add key → Create new key → JSON. A .json file downloads — keep it safe.
On the service account's Details page, copy its numeric Unique ID / Client ID (e.g. 10494…). You need it in step 3.

Note: the Client ID (a long number) is what authorises delegation. It is not the same as your Workspace Customer ID (format C0xxxxxx) — don't mix them up in the AllowNow form.

Enable domain-wide delegation and authorise scopes

5 minutes

This is the step people miss — the service account can read nothing until a Workspace admin allow-lists it.

In admin.google.com → Security → Access and data control → API controls → Manage Domain-wide Delegation, click Add new, paste the service account's Client ID from step 2, and enter these exact read-only scopes (comma-separated), then Authorise:

https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly

Connect the account in AllowNow

2 minutes

In AllowNow: Connectors → Add connector → Google Workspace. Fill in:

Admin email (impersonated): a super-admin in your domain — the connector reads the directory as this person.
Customer ID: leave blank (AllowNow auto-detects it).
Service account email: the client_email from the JSON key.
Service account private key: the private_key value from the JSON (paste the whole -----BEGIN PRIVATE KEY----- … block).

Click Connect & test. Credentials are encrypted at rest and never returned to the browser.

Sync and review drift

2 minutes

On the connector card, click Sync now. AllowNow pulls users, super/delegated admins, and group memberships. Open Drift review to see:

Undocumented access — someone in Google who isn't an AllowNow user. Click Import user to add them.
Stale record — an AllowNow user who has left the Google directory. Click Remove user to deactivate them.

Keep it live: point a scheduler at the sync endpoint to refresh automatically, or just click Sync now before each access review.

Troubleshooting

❌ 400 / “Bad Request” on sync
→ Usually a wrong Customer ID. Leave the field blank so AllowNow resolves it from your admin account.
❌ 403 / “unauthorized_client”
→ The scopes weren't authorised against the service account's numeric Client ID, or an exact-match typo. Re-check step 3.
❌ 404 / “Resource Not Found: userKey”
→ The impersonated admin email isn't a real user in that Workspace, or isn't a super-admin.

Turn your directory into audit evidence

Once connected, AllowNow keeps a living record of who has access to what — with periodic reviews, full audit trails, and one-click reports.

Get started free