Google Workspace setup instructions

1. 1Go to the Google Cloud Console and create a new project or select an existing one.
2. 2Navigate to APIs & Services > Library, search for Admin SDK API, and click Enable.
3. 3Go to IAM & Admin > Service Accounts and click Create Service Account; give it a name (e.g., dex-management-sa), click Create and Continue, skip optional permissions, and click Done.
4. 4Select the service account, go to the Keys tab, click Add Key > Create new key, select JSON, and download the key file.
5. 5Open the JSON key file — you will need the client_email (Service Account Email), the private_key (Private Key PEM), and the client_id.
6. 6Open the Google Workspace Admin Console and go to Security > Access and data control > API controls.
7. 7Under Domain-wide delegation, click Manage Domain-Wide Delegation, then click Add new.
8. 8In the Client ID field, paste the client_id (numeric string) from the JSON key file.
9. 9In the OAuth scopes field, paste this comma-separated list, then click Authorize: https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.directory.group, https://www.googleapis.com/auth/admin.directory.orgunit, https://www.googleapis.com/auth/admin.directory.device.mobile, https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly, https://www.googleapis.com/auth/admin.directory.resource.calendar

The connection form in the Dex app store asks for these values: