> ## Documentation Index
> Fetch the complete documentation index at: https://braintrust.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Google OAuth for Google Workspace domains

> Enable Google Workspace users to sign in with Google OAuth immediately, then migrate to custom SAML SSO when a super-admin is available.

export const plans_0 = "Enterprise"

export const deployments_0 = "Any"

export const data_plane_version_0 = undefined

export const use_case_0 = "Use case - Enable users from Google Workspace domains to sign in immediately using Google OAuth as a temporary alternative to full SAML SSO, plus step-by-step SAML setup instructions when ready"

<Note>
  **Applies to:**

  * Plan - {plans_0}
  * Deployment - {deployments_0}
  * {data_plane_version_0}
  * {use_case_0}
</Note>

## Summary

Users who cannot complete a Google Workspace custom SAML setup can use Google OAuth ("Continue with Google") for immediate access. SAML requires a Google Workspace super-admin to create a custom SAML app and export IdP metadata. Choose OAuth for day‑0 access and convert to SAML later by providing the IdP metadata XML to support.

## What is happening

If you do not have super‑admin rights in Google Workspace you cannot create a custom SAML app. That blocks completing SAML SSO. Braintrust supports standard Google OAuth sign‑in without a custom SAML app. Braintrust can later apply SAML settings once you provide the Google IdP metadata XML.

## Fix or suggestion

### Option 1: Use Google OAuth for immediate access

* Ask Braintrust support to confirm Google sign-in and domain mapping for your organization.
* Provide the list of allowed email domains, for example `example.com` so sign‑ins are limited to those emails.
* Invite initial users, or have users from the mapped domains sign in with "Continue with Google".
* Start work immediately while you plan SAML.

### Option 2: Set up SAML SSO via Google Workspace

* Have a Google Workspace super‑admin create a custom SAML app.
* Use the ACS URL and Entity ID supplied by Braintrust when creating the app.
* In Google Workspace, export the IdP metadata XML (the Google IdP metadata file).
* Send the exported IdP metadata XML to Braintrust support.
* Braintrust support will apply the SAML configuration and help verify sign-on. Request removal of any temporary configs if needed.

## How to confirm it worked

* OAuth: Sign in with "Continue with Google" using an allowed domain email. You should reach the Braintrust org and see your account created or listed.
* SAML: Attempt SAML sign‑in and confirm a successful redirect and authenticated session with no SAML errors.

## Notes

* [Google Workspace: Set up your own custom SAML app](https://support.google.com/a/answer/60224)
* [Braintrust SSO documentation](/admin/authentication#single-sign-on-sso)
* Google OAuth is useful for immediate access, but it is not a replacement for SAML if you need IdP-managed SAML policies or SAML group mapping.