Skip to main content
Connect Origin to Google Workspace (Google ID) so your users, groups, group memberships, organizational units, and devices stay in sync with your directory. Once connected, the synced data appears in the Directory Browser in your Origin dashboard, and each endpoint Origin sees is correlated to the person and device it belongs to.

​
How it works

Create a Google Cloud service account, grant it read-only access to your directory via domain-wide delegation, and paste three values — your Customer ID, an Admin Email to impersonate, and the service account’s JSON key — into Origin. The whole flow takes about ten minutes and requires a Google Workspace Super Admin and a Google Cloud project you can administer.

​
What you’ll end up with

​
Before you begin

You need:
  1. A Google Cloud project you can administer — pick an existing one or create a new one for this integration.
  2. Google Workspace Super Admin access — required to authorize domain-wide delegation and to look up your Customer ID.
  3. An Origin admin account — only Origin admins can create directory integrations.

​
Setup steps

1

Enable the required Google Cloud APIs

  1. In the Google Cloud console, select or create the project you’ll use for this integration.
  2. Go to APIs & Services → Library.
  3. Enable exactly two APIs: Admin SDK API and Cloud Identity API. Nothing else is needed.
Without the Cloud Identity API, users and groups still sync, but devices never do — and nothing reports an error when this API is missing.
2

Create a service account and key

  1. In the same project, go to IAM & Admin → Service Accounts and create a new service account.
  2. Open the new service account, go to Keys → Add key → Create new key, and choose JSON.
  3. Save the downloaded file — you’ll paste its entire contents into Origin’s Service Account JSON field later.
It has to be a service-account key. An OAuth client-ID JSON downloaded from the Credentials page looks similar and is valid JSON, so it saves into Origin without complaint — and only fails later, when Origin asks Google for a token.
3

Copy the service account's Unique ID

On the service account’s Details tab, copy its Unique ID — the long number, not the service account’s email address. This is the client ID the next step asks for.
4

Authorize domain-wide delegation

  1. Sign in to the Workspace admin console as a Super Admin.
  2. Go to Security → Access and data control → API controls → Domain-wide delegation → Add new.
  3. Paste the service account’s Unique ID into Client ID.
  4. Paste all nine OAuth scopes below into OAuth scopes, then click Authorize.
Grant all nine scopes in one authorization. A partial grant is the hardest failure to diagnose — Google’s error does not say which scope is missing. If Origin adds scopes in a future release, syncing stops until an admin re-authorizes the same client ID with the new list.
5

Find your Customer ID

In the Workspace admin console, go to Account → Account settings. Your Customer ID starts with C (for example, C0xxxxxxx).
6

Connect from the Origin dashboard

  1. Sign in to the Origin dashboard at dashboard.originhq.com.
  2. Click Admin in the left sidebar, then select Identity.
  3. On the Integrations tab, click Add Integration.
  4. In the New integration dialog, fill in:
    • Display name — a label for this integration, e.g. Google Workspace. Only used to identify it in the list.
    • Provider — set to Google Workspace.
    • Customer ID — the ID you copied in the previous step.
    • Admin Email — the email address of the Super Admin the service account impersonates. Google requires delegation to impersonate a real administrator; because every granted scope is read-only, the service account can only read what that administrator could.
    • Service Account JSON — paste the entire contents of the JSON key file you downloaded earlier.
  5. Click Create.
Origin saves the integration and runs its first sync shortly after.
7

Verify in the Directory Browser

From the Directory Integrations page, use the tabs across the top:
  1. Users — should list everyone in your Workspace directory. Click any user to see their direct groups.
  2. Groups — click any group to see its direct members.
  3. Devices — devices registered with Cloud Identity appear here, each resolved to an Owner against the synced users.
If you’ve registered endpoints in Origin and their serial numbers or hostnames match, those endpoints light up with the matched directory user under Assigned identity.

​
What gets synced (and what doesn’t)

Synced:
  • Users — display name, email, status, organizational unit, and custom schema attributes covered by the granted scope.
  • Groups — display name, description, and membership.
  • Organizational units.
  • Devices registered with Cloud Identity.
Not synced:
  • Gmail, Drive, Calendar, or any Workspace application data outside the directory itself.
  • Role and permission assignments beyond identifying which accounts are super-admins or delegated admins.

​
Troubleshooting

Display name, Customer ID, Admin Email, and Service Account JSON are all required — Origin won’t submit the form until every field has a value.
Confirm the file pasted into Service Account JSON is a service-account key — downloaded from Keys → Add key on the service account — and not an OAuth client-ID JSON from the Credentials page. Both are valid JSON, so Origin accepts either at save time, and only a service-account key succeeds when Origin requests a token from Google.
Confirm the Cloud Identity API is enabled for the Google Cloud project the service account belongs to. Without it, device sync fails silently — nothing in the UI reports the missing API.
One or more of the nine OAuth scopes is likely missing from the domain-wide delegation authorization. Google’s error does not name the missing scope, so reopen the domain-wide delegation entry for this client ID in the Workspace admin console and confirm the full scope list matches exactly what’s listed above.
The service account can only read what the impersonated Admin Email account could read itself. Use a full Super Admin account, not a delegated admin with a narrower role.

​
Removing the integration

  1. In Directory Integrations, delete the integration from its row’s actions. Syncing stops immediately; data already in Origin follows your tenant’s retention settings.
  2. To also revoke access on the Google side, remove the domain-wide delegation entry for the service account’s client ID from Security → Access and data control → API controls → Domain-wide delegation in the Workspace admin console, and optionally delete the service account and its key in Google Cloud.