Google permissions

A Google Workspace administrator or a security officer checks what RingSync can do in their Google domain before granting access, and how to remove it.

What RingSync requests

RingSync reads the users and groups of your domain to build the contacts on phones and to compute who has access to the app. It does not create, modify or delete any user, group or contact in your domain. The three scopes are read-only:

https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.group.member.readonly

Scope	What it allows	Why RingSync needs it
`admin.directory.user.readonly`	Read the profiles of the domain's users.	Build the contacts: first name, last name, email, phones, job title, department, company, suspended state and photo. Check the directory connection.
`admin.directory.group.readonly`	List the domain's groups.	Fill the group lists in the dashboard.
`admin.directory.group.member.readonly`	Read the members of a group, including nested groups.	Apply Authorized seats, Sync scope and Groups to exclude.

These scopes cover the whole domain, not only the people who have a seat: the scope of synced contacts is set in RingSync. See Select and exclude groups and Synced information.

Read-only by design

Google classifies these scopes as sensitive, but they only give read access to the directory. RingSync requests no write scope, and no access to email, calendar or Drive.

Where the scopes are granted

Service Account (DWD): in the Google Admin Console, under Security → API controls → Domain-wide delegation, tied to your Service Account's numeric Client ID.
Sign in to Google: on Google's consent screen, when the administrator signs in and accepts.

Audit the access

Service Account (DWD): in the domain-wide delegation, the Service Account's entry must list exactly the three scopes above.
Sign in to Google: in RingSync, Settings shows the account that consented under Delegated admin.

Revoke access

Follow this order so that contacts are also removed from phones.

In RingSync, open Settings → Danger zone, click Delete the directory, then confirm with Delete. Seats, syncs, settings and encrypted credentials are deleted, and phones purge the directory's contacts.
At Google:
- Service Account (DWD): delete the domain-wide delegation entry, then delete the key, or the Service Account, in your Google Cloud project.
- Sign in to Google: remove the access granted to RingSync from the account of the administrator who consented.

If you only revoke at Google

RingSync can no longer read the directory: syncs fail and the removal of a seat can no longer be detected. Contacts already on phones stay there. To remove them, delete the directory in RingSync (step 1). Each person can also tap Remove synced contacts in the app settings. The purge happens at the latest the next time the app is opened, and sooner if the app is in the foreground or a sync is running. See Security and data.

Technical details

Calls: /admin/directory/v1/users (full list, 500 users per page, and one user at a time), /groups, /groups/{groupKey}/members and /users/{userKey}/photos/thumbnail for the photo.
Token: with Service Account (DWD), RingSync signs a token request with the Service Account's key and acts on behalf of the administrator entered in Admin email to impersonate. With Sign in to Google, it exchanges an encrypted refresh token. In both cases the access token is short-lived and only the three scopes are requested.
Timeout: each call to Google has a maximum timeout of 60 seconds on the server side.
Setup: step by step in Google Workspace.

Was this page useful?

Report what is missing →

← Previous

Google Workspace

How sync works