Google Workspace

A Google Workspace administrator connects their domain to RingSync, with a Service Account or with their administrator sign-in, then chooses who has access to the app.

Choose the method

RingSync reads your directory with the Admin SDK Directory API, read-only. The Connect a directory form offers two methods.

Prerequisites

• A RingSync account with the Owner or Admin role.
• A Google Workspace administrator account that can open the Google Admin Console.
• For Service Account (DWD): a Google Cloud project where you can enable an API, create a Service Account and a key.
• For Service Account (DWD): the email of a Workspace administrator who can read the directory. The Service Account acts on their behalf.

Method 1: Service Account (DWD), recommended

The Service Account lives in your Google Cloud project. RingSync only receives its JSON key, keeps it encrypted and uses it read-only.

Create the Service Account in Google Cloud

1. Open console.cloud.google.com and create or choose a project.
2. Enable the Admin SDK API in this project.
3. Open IAM & Admin → Service Accounts and create a service account.
4. Open this service account, then Keys → Add key → JSON, and download the key. Keep the file confidential.
5. Note the service account's numeric Client ID: it is the client_id field of the JSON file.

Authorize delegation in the Google Admin Console

1. Open admin.google.com with an administrator account.

2. Open Security → API controls → Domain-wide delegation.

3. Add a new delegation entry.

4. Enter the numeric Client ID noted above.

5. Paste this line of OAuth scopes, as is. The RingSync form also shows it under OAuth scopes to authorize (comma-separated):

   https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly

6. Confirm the authorization.

Connect the directory in RingSync

1. Click Connect a directory, then enter the Directory name.
2. At the Directory provider step, choose Google Workspace.
3. Choose the Service Account (DWD) method.
4. In Workspace domain, enter your domain, for example acme.com.
5. In Admin email to impersonate, enter the address of the administrator whose identity the Service Account uses.
6. In Service Account key (JSON), paste the full content of the downloaded file.
7. Click Test connection and wait for Connection successful. Nothing is saved at this stage.
8. Click Connect the directory.

RingSync encrypts the key, stores the Google customer identifier of your domain (shown as Customer ID in Settings), computes the seats, then takes you to the directory dashboard.

For your security team

• You keep control. The Service Account is in your project: you cut access by deleting its key in Google Cloud or the delegation entry in the Google Admin Console.
• Read-only. The delegation grants only the three scopes listed above: no email, no Drive, no write access. See Google permissions.
• On the RingSync side. The key is stored encrypted and the dashboard does not display it.
• Impersonated account. It must remain an administrator account that can read the directory. Otherwise Google refuses access and reading the directory stops.
• Key rotation. The dashboard cannot replace the key of a Google directory that is already connected, and deleting the key in Google Cloud cuts the connection. Contact us before any rotation.

Method 2: Sign in to Google

You have nothing to create in Google Cloud: you authorize RingSync's application with your administrator account.

1. Click Connect a directory, enter the Directory name, choose Google Workspace, then Sign in to Google.
2. Optional: enter the Workspace domain (optional) to restrict the Google account picker to your domain.
3. Click Sign in to Google.
4. Sign in with a Google Workspace administrator account that can read the directory, then grant read-only access to the directory.
5. You return to the directory dashboard.

RingSync keeps an encrypted refresh token. The account you signed in with is then used to read the directory: it appears as Delegated admin in Settings. If this account removes the access granted to RingSync, reading the directory stops.

Decide who has access

Google has no application assignment comparable to Entra's: seats are set in RingSync.

1. Open Settings → Authorized seats.
2. Choose All domain users (the default) or Members of specific groups.
3. For groups, click Add a group, search for the group, then select it. Members of nested groups count too.
4. Click Save.

RingSync recomputes the seats every 15 minutes. To apply the change right away, click Sync from directory on the Users page.

• Plan limit: beyond the number of seats in your plan, the extra people do not get a seat. With All domain users, check that your plan covers the whole domain. See Seats and limits.
• Removing someone: take the person out of the chosen group, or delete their account. At the next pass, 15 minutes at most, their seat is revoked and their phones purge the directory's contacts. See Security and data.

Verify the connection

1. In Dashboard → Directory connection, the status is Working.
2. The Users page lists the authorized people.
3. On a phone, the person taps Sign in with Google, the directory appears, then the first sync succeeds.

Troubleshooting

Technical details

• API and scopes. RingSync uses the three read-only scopes admin.directory.user.readonly, admin.directory.group.readonly and admin.directory.group.member.readonly, in both methods.
• No delta. The Admin SDK Directory API has no equivalent of Microsoft's delta: each sync reads the full list of users again. See How sync works.
• Domain identifier. RingSync identifies your directory by its immutable Google customer identifier (Customer ID in Settings), and refuses a domain that is already connected.
• Seats. With Members of specific groups, seats are the union of the members, nested ones included, of the listed groups. Only people who have an email address are kept.