Google Workspace: Single Sign-On & User Sync

Time needed: about 30 minutes. This guide connects StaffCircle to Google Workspace for single sign-on and automatic user sync.

Before you start — you'll need three things

A Google Workspace super admin — someone who can sign in to your organisation's Google Admin console with full (super administrator) rights.
Access to Google Cloud Console — the same person (or your IT team) needs to be able to create a project at console.cloud.google.com. It's free for this purpose.
A StaffCircle administrator login — someone with access to Settings › Integrations in your StaffCircle platform.

How it works, in plain English. You'll create a small “service account” in Google — think of it as a robot key that lets StaffCircle read your staff directory. You then tell Google exactly what that key is allowed to see (names and user details only), and paste the key into StaffCircle. That's it.

Phase 1 — Create the connection key (Google Cloud Console)

This part happens at console.cloud.google.com. It creates the secure key StaffCircle will use.

Who does this: your Google / IT admin

Step 1 — Open Google Cloud Console and pick a project

Go to console.cloud.google.com and sign in with your Google Workspace admin account. Use the project picker at the top of the page to select an existing project, or click New Project and give it a name like “StaffCircle Integration”.

Step 2 — Create a service account

From the menu, go to IAM & Admin › Service Accounts and click + Create Service Account. Name it something recognisable, e.g. staffcircle-sync.

When Google asks about granting roles or user access, skip both steps — just click through and create it. The account doesn't need any special roles.

Step 3 — Copy the Client ID

Click your new service account to open it, then expand Advanced settings. Under “Domain-wide delegation” you'll see a long number called the Client ID. Copy it somewhere handy — you'll need it in Phase 2.

Step 4 — Download the key file

Still inside the service account, open the Keys tab and choose Add Key › Create new key › JSON. A small file downloads to your computer.

Keep this file safe. Google only lets you download it once — if you lose it, you'll need to create a new key.

Step 5 — Switch on the Admin SDK

From the menu, go to APIs & Services › Enabled APIs & services, click + Enable APIs and Services, search for Admin SDK API, and click Enable. This is what allows your staff directory to be read.

If Google won't let you create the key: newer Google organisations sometimes block key downloads by default for security. If step 4 shows an error about “key creation being disabled”, your Google Cloud administrator needs to allow key creation for this project (the setting is called iam.disableServiceAccountKeyCreation). Once lifted, repeat step 4.

Phase 2 — Give the key permission (Google Admin console)

Now tell Google what the key is allowed to see. This happens at admin.google.com and needs a super administrator.

Who does this: your Google Workspace super admin

Step 6 — Open Domain-Wide Delegation

Go to admin.google.com and navigate to Security › Access and data control › API controls, then click Manage Domain Wide Delegation.

Step 7 — Add the Client ID and permissions

Click Add new. Paste the Client ID you copied in step 3, then in the “OAuth scopes” box add these two lines (comma-separated):

https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.user.readonly

Click Authorize. These permissions only cover user directory details — nothing else in your Workspace.

Phase 3 — Connect it to StaffCircle

Back in your StaffCircle platform — this is the screen with the Google logo and the toggle switches.

Who does this: your StaffCircle administrator

Step 8 — Install the Google integration

Go to Settings › Integrations, find Google, and add it. Once added, it shows a green Installed badge and the Settings panel appears below.

Step 9 — Add your domain and admin email

In Domain Whitelist, type your company's email domain (e.g. yourcompany.com) and click the +. Only people with email addresses on whitelisted domains will be able to sign in with Google.

In Admin email, enter the email address of your Google Workspace super admin. This is the account the connection reads the directory through.

Step 10 — Paste in the key file

Open the JSON key file you downloaded in step 4 (it opens in any text editor such as Notepad or TextEdit). Select everything in it, copy, and paste it into the box called Client Credentials For Connecting To Your Google Workspace.

Step 11 — Choose your toggle settings

Set the seven switches to suit how you want the connection to behave. Our recommended starting point:

Setting	What it does	Start with
Autoprovision Users	If someone signs in with Google and doesn't have a StaffCircle account yet, one is created (or activated) for them automatically.	ON
Google Login Only	Hides the normal username & password login so everyone must use Google.	OFF for now
Autosync	Automatically refreshes user details from Google twice every hour.	ON
Sync All	Marks every user in your Google directory as ready to sync, rather than picking them one by one.	Your choice
Sync Department Information	Brings departments across from Google. If a department doesn't exist in StaffCircle yet, it's created for you.	Your choice
Sync Manager Information	Brings each person's manager across, so reporting lines are set up automatically.	Your choice
Sync Personal Information	Brings across personal details like home address, mobile and home phone.	Your choice

Important — don't lock yourself out. Leave Google Login Only switched OFF until you've confirmed at least one person can successfully sign in with Google (step 14). Turning it on too early can lock everyone — including you — out of the platform.

Phase 4 — Bring your people in

Who does this: your StaffCircle administrator

Step 12 — Import from Workspace

Click Import From Workspace. This saves your toggle settings and pulls your Google users into the Google Users table lower down the page. (If you only want to save the toggles without importing yet, click Save Settings instead.)

Give it a moment, then refresh the page to see the full list.

Step 13 — Choose who to sync

The imported people aren't StaffCircle users yet. Review the table, tick the people you want to bring across, and click the Sync button at the bottom of the table. You can come back and sync more people at any time.

Step 14 — Test with one person

Ask one synced colleague to go to your StaffCircle login page and choose Sign in with Google. If they land in StaffCircle successfully, the connection is working.

Step 15 — (Optional) Switch to Google-only login

Once you're happy everything works, you can turn on Google Login Only to remove the username & password option. You can switch it back off at any time.

Final checks

A test user can sign in to StaffCircle with their Google account.
The people you selected appear as active StaffCircle users.
If Autosync is on: change a detail in Google (e.g. someone's department) and confirm it appears in StaffCircle within the hour.
The JSON key file is stored somewhere safe — and deleted from Downloads folders it doesn't need to be in.

Need a hand? If anything doesn't look the way this guide describes, or you'd like us on a call while you set it up, contact your Account Manager or get in touch — we're happy to walk you through it.