This is the Google Cloud setup that produces the Client ID and Client Secret used throughout ExSign for Google Workspace, on the Security for Google Workspace (Google Auth), and on the organization-level Google Configurations screen. Do this once; the same registration is reused across both.

Create a Project in Google Cloud 

1. Go to the Google Cloud Console and sign in using a Google Workspace Admin account. 
2. From the top menu, click Select Project, then New Project. 
3. Enter a project name and click Create.

Configure the OAuth Consent Screen 

1. Open the navigation menu (?) and go to APIs & Services > OAuth Consent Screen. 
2. Click Get Started. 
3. Fill in the required App Information: App Name, User Support Email, Developer Contact Email.
4. Click Next. 
5. Select User Type as External (for organization-wide usage). 
6. Click Next, enter your Contact Information, then click Finish. 

Create OAuth Client Credentials 

1. Go to APIs & Services >> Credentials. 
2. Click Create Credentials >> Create OAuth Client. 
3. Set Application Type to Web Application. 
4. Add the Authorized Redirect URI(s) your deployment needs, for example:  
   • https://yourdomain.com:8775/google/oauth/callback 
   • https://yourdomain.com:8775/Login/GoogleLoginCallback 
5. Click Create. 

Enable the Admin SDK API 

1. Go to APIs & Services >> Enabled APIs & Services. 
   
2. Click Enable APIs and Services. 
   
3. Search for Admin SDK API, select it, and click Enable. 

Configure OAuth Scopes 

Go to OAuth Consent Screen >> Data Access. This defines what Google Workspace data the application can access. 

Non-sensitive scopes are automatically managed by Google and don't usually need manual approval, just review them to confirm they match expected behavior. 

Sensitive scopes must be added manually and require admin approval. Add all five: 

• https://www.googleapis.com/auth/admin.directory.group.readonly  
• https://www.googleapis.com/auth/admin.directory.user.readonly 
• https://www.googleapis.com/auth/admin.directory.group.member.readonly 
• https://www.googleapis.com/auth/admin.directory.domain.readonly 
• https://www.googleapis.com/auth/admin.directory.orgunit.readonly  

All five are read-only access to directory data, this is what lets ExSign pull user profile information for personalizing signatures (see Sync Users Profile on Adding Entities and Organizations (Google Workspace)). A missing scope can cause authentication or API permission errors later, so don't skip any. 

Before You Consider this Done 

• Confirm the OAuth app is fully authorized before using it in production. 
• Sensitive scopes genuinely require Workspace Admin consent, don't assume they're active just because you added them.