---
title: "Integrate with Google Workspace"
slug: "integrate-with-google-workspace"
status: "new"
updated: 2026-10-16T10:04:50Z
published: 2026-10-16T10:04:50Z
canonical: "docs.revealdata.com/integrate-with-google-workspace"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revealdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate with Google Workspace

When you integrate Reveal Hold with Google Workspace, your users sign in to Reveal Hold with their Google account, and you control access to Reveal Hold centrally from your Google organization. The integration also enables synchronization of your employee directory into the Reveal Hold address book, so contacts stay current automatically.

Setting up the integration consists of two parts: this article covers creating the Google Cloud project and OAuth client that Reveal Hold uses for single sign-on. The follow-up article, **Create a Google Service Account to Synchronize Users**, covers the service account used for address book synchronization.

### Prerequisites

- A Google Workspace subscription for your organization.
- A Google account with permission to create projects in the **Google Cloud console** (console.cloud.google.com) for your organization.
- A **Super Admin** (or equivalent) account for the **Google Admin** console (admin.google.com), required for the service account steps in the follow-up article, which are needed for both role mapping and address book synchronization
- The URL of your Reveal Hold environment, as provided by Reveal.

### Create a Google Cloud project

Reveal Hold is registered in your Google organization as an OAuth application inside a dedicated Google Cloud project.

1. Go to **console.cloud.google.com** and sign in with an account in your organization.
2. Select the **project selector** drop-down at the top of the page and select **New project**![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/select-source.png)
3. Enter a **Project name**, for example “Reveal Hold”.
4. Select your organization’s domain as the **Organization** and as the **Parent resource** (or use a specific folder if your organization requires this), then select **Create**

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/new-project.png)

### Configure the OAuth consent screen

1. In the new project, go to **APIs & Services** > **Credentials**.
2. Select **Create credentials** > **OAuth client ID**. Google will prompt you to configure the OAuth consent screen first.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/credentials.png)
3. Under **App Information**, enter an **App name** (for example “Reveal Hold”) — this is the name your users see on the Google sign-in consent screen — and select a **User support email**. Click **Next**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/app-info.png)
4. Under **Audience**, select **Internal**, then select **Next**.

> [!NOTE]
> Note
> 
> Internal means only users within your Google Workspace organization can sign in to Reveal Hold with this application. No Google app verification submission is required for internal applications.

1. Under **Contact Information**, add a developer contact email address and select **Next**.
2. Under **Finish**, agree to the **Google API Services: User Data Policy**, select **Continue.**
3. Finally, select **Create**.

### Create the OAuth client ID

1. On the **OAuth Overview** page, select **Create OAuth client**.
2. Select **Web application** as the **Application type** and enter a name.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/aouthclient.png)
3. Under **Authorized JavaScript origins**, add the URL of your Reveal Hold environment: https://<your Reveal Hold URL>
4. Under **Authorized** redirect URIs, add https://<your Reveal Hold URL>/signin-mt-oidc/
5. Select **Create**.

> [!NOTE]
> Note
> 
> It may take from 5 minutes to a few hours for these settings to take effect on Google’s side.
6. Copy the **Client ID** and **Client secret** shown after creation. You will need these when configuring the integration in Reveal Hold.

### Add data access scopes

Reveal Hold only requests non-sensitive sign-in scopes; it does not request access to your users’ data through the OAuth client.

1. In the left sidebar, select **Data Access**, then select **Add or remove scopes**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/data-access.png)
2. Select the three sign-in scopes:
  1. **.../auth/userinfo.email,**
  2. **.../auth/userinfo.profile, and**
  3. **openid.**
3. Click **Update**, then **Save**. All three scopes will appear under **Your non-sensitive scopes**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/SSO%209.png)

### **Configure the integration in Reveal Hold**

Google integration is configured by Reveal Support, not self-service. Unlike the Ping Identity flow, there is no screen where a customer enters a Client ID / Client secret / domain directly in Reveal Hold.

1. Complete the steps in **Create a Google Service Account to Synchronize Users**.
2. Provide your Google Workspace **Client ID**, **Client secret**, **domain**, and **service account details** to Reveal Support through a secure channel. Reveal Support configures the integration and enables group-based role mapping.
3. Once Reveal Support confirms the setup, synchronize your contacts as described in **Create a Google Service Account to Synchronize Users**.

### Assign users and roles

Roles are mapped via a GroupsMapping configuration set up by Reveal Support. At login, Reveal takes the user’s Google Workspace Admin Directory groups and maps matching group names to Reveal roles (e.g., a group named "Reveal Hold - System Administrator" maps to the **System Administrator** role). Mapped roles are further capped by the tenant's trusted-roles allow-list.

At minimum, make sure that:

- one Google Group is mapped to **System Administrator**, to configure the integration and synchronize contacts, and
- one Google Group is mapped to **Global Hold Manager**, to test sending preview emails.

### Synchronize contacts

To keep the Reveal Hold address book up to date with your Google directory, create a service account with domain-wide delegation as described in **Create a Google Service Account to Synchronize Users**, and see **Address Book Synchronization** for how synchronization works.