Skip to main content
Applies to:
  • Plan -
  • Deployment -

​
Summary

Users who cannot complete a Google Workspace custom SAML setup can use Google OAuth (“Continue with Google”) for immediate access. SAML requires a Google Workspace super-admin to create a custom SAML app and export IdP metadata. Choose OAuth for day‑0 access and convert to SAML later by providing the IdP metadata XML to support.

​
What is happening

If you do not have super‑admin rights in Google Workspace you cannot create a custom SAML app. That blocks completing SAML SSO. Braintrust supports standard Google OAuth sign‑in without a custom SAML app. Braintrust can later apply SAML settings once you provide the Google IdP metadata XML.

​
Fix or suggestion

​
Option 1: Use Google OAuth for immediate access

  • Ask Braintrust support to confirm Google sign-in and domain mapping for your organization.
  • Provide the list of allowed email domains, for example example.com so sign‑ins are limited to those emails.
  • Invite initial users, or have users from the mapped domains sign in with “Continue with Google”.
  • Start work immediately while you plan SAML.

​
Option 2: Set up SAML SSO via Google Workspace

  • Have a Google Workspace super‑admin create a custom SAML app.
  • Use the ACS URL and Entity ID supplied by Braintrust when creating the app.
  • In Google Workspace, export the IdP metadata XML (the Google IdP metadata file).
  • Send the exported IdP metadata XML to Braintrust support.
  • Braintrust support will apply the SAML configuration and help verify sign-on. Request removal of any temporary configs if needed.

​
How to confirm it worked

  • OAuth: Sign in with “Continue with Google” using an allowed domain email. You should reach the Braintrust org and see your account created or listed.
  • SAML: Attempt SAML sign‑in and confirm a successful redirect and authenticated session with no SAML errors.

​
Notes