Google Workspace

Setup

1. Create an OAuth 2.0 client

• Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth client ID
• Application type: Web application
• Authorised redirect URIs: https://tappass.example.com/sso/callback

Note the Client ID and Client Secret.

2. Configure OAuth consent screen

• User type: Internal (Workspace users only)
• Scopes: openid, email, profile

3. Configure TapPass

TAPPASS_SSO_PROVIDERS=google
TAPPASS_SSO_GOOGLE_CLIENT_ID=<client-id>.apps.googleusercontent.com
TAPPASS_SSO_GOOGLE_CLIENT_SECRET=<client-secret>
TAPPASS_SSO_REDIRECT_URI=https://tappass.example.com/sso/callback
TAPPASS_SSO_ALLOWED_DOMAINS=yourcompany.com

TAPPASS_SSO_ALLOWED_DOMAINS restricts sign-in to your Workspace domain — personal Gmail accounts are rejected.

Sign-in flow

GET /sso/login?provider=google  →  Google consent  →  GET /sso/callback  →  POST /sso/exchange

POST /sso/exchange swaps the one-time code from the callback for a TapPass session token.

Multiple providers

Google and Azure can run side by side:

TAPPASS_SSO_PROVIDERS=google,azure

Each user picks their provider on the login page; the same TAPPASS_SSO_ALLOWED_DOMAINS allowlist applies to both.