Google permissions
What RingSync requests
RingSync uses three read-only Admin SDK Directory scopes:
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.group.member.readonly| Scope | Used for |
|---|---|
admin.directory.user.readonly | Reading user objects to build contacts. |
admin.directory.group.readonly | Reading group objects (used for group filtering). |
admin.directory.group.member.readonly | Resolving group membership for group-scoped sync. |
Read-only by design
These scopes are marked sensitive by Google but grant read-only access to the directory. RingSync never requests write scopes, nor mail, calendar, or Drive access.
Where the scopes are granted
- Method B (Service Account + DWD) — the scopes are authorized in the Google Admin console under Security → API controls → Domain-wide delegation, bound to the service account's numeric Client ID.
- Method A (Admin OAuth) — the scopes are declared on the OAuth consent screen and granted when the admin signs in and consents.
Auditing access
- Method B — review Security → API controls → Domain-wide delegation in the Admin console; the RingSync service account's Client ID should list exactly the three scopes above. Directory reads appear in Google Audit logs.
- Method A — review the authorized third-party apps for the consenting admin account, and the OAuth client under Google Auth Platform → Clients.
Revoking access
- Method B — delete the domain-wide delegation entry in the Admin console, and/or delete the service account key in your GCP project.
- Method A — revoke the app's access from the admin's Google account, and/or delete the OAuth client.
- In all cases, also remove the directory in the RingSync back office so it stops attempting to read the directory.
Effect of revocation
Once access is revoked, RingSync can no longer read the directory and syncs fail. Contacts already on devices remain until a wipe is triggered or the app is removed.
Was this page useful?
Report what is missing →