Before you start
- A Google Cloud project in your Workspace organisation, and permission to create OAuth clients in it.
- The workspace address TenCrown gave you, for example yourcompany.app.tencrown.com.
- Your Workspace domain, for example yourcompany.ie.
1. Create the OAuth client
Step 1: Set the consent screen to Internal
In your Google Cloud project, open the OAuth consent screen and choose the Internal user type. This limits sign-in to your organisation. We also check the email domain at every sign-in.Step 2: Create a Web application client
Create an OAuth client ID of type Web application, with these three authorised redirect URIs. Replace yourcompany with your own name, and copy them exactly.Redirect URI 1 https://yourcompany.app.tencrown.com/oauth/openid/callback Redirect URI 2 https://yourcompany.app.tencrown.com/api/admin/oauth/openid/callback Redirect URI 3 https://yourcompany.app.tencrown.com/api/mcp/google-workspace/oauth/callback
2. Send us the details
| Client ID | From the OAuth client you just created |
|---|---|
| Workspace domain | For example yourcompany.ie |
| Secret expiry or review date | When the secret expires, or the date you want a reminder |
| Your first admin | The work email of the person who should be your first admin |
Never email the client secret
Send the details above to [email protected]. The client secret itself is not for email. Once we have the details, we send you a one-time secure link. Paste the secret into it. The link works once, and we enter the secret into your environment ourselves.
Roles on Google are different
Google does not send roles, so everyone starts as an ordinary user. Your first admin signs in once. Then we make them an admin. To add or remove an admin later, email us.
Sessions last up to 8 hours
If you disable someone in Google, they cannot sign in again at once. A session they already have open can run for up to 8 hours. Plan for that in your leaver process.
If something goes wrong
- A redirect error at sign-in. Almost always a redirect URI typed differently from the three above. Compare them character by character.
- Someone from outside your organisation cannot sign in. That is by design.
- Still stuck. Email [email protected] and tell us the error text.