Connect Google Workspace

Before you start

• An organization in Paycux for the customer, with their Workspace domain claimed.
• A Google Workspace super admin. Delegated admins cannot create custom SAML apps.
• The ACS URL and entity ID from the Paycux connection.
• A view on scope: which org units or groups should be able to reach your product. Turning an app on for everybody is the default and is rarely what the customer wants.

Create the SAML app

1. 1In the Google Admin console open Apps, then Web and mobile apps.
2. 2Choose Add app, then Add custom SAML app.
3. 3Name the app as your customer's staff will see it and upload your icon.
4. 4On the Google Identity Provider details screen, download the IdP metadata file. Keep it — this is the only screen that offers it conveniently.
5. 5On the Service provider details screen, paste the Paycux ACS URL and the Paycux entity ID.
6. 6Set Name ID format to EMAIL and Name ID to Basic Information > Primary email.
7. 7Leave Signed response unchecked unless your connection is configured to expect it.

Map the attributes

Google sends only the name ID unless attributes are mapped, so this step is not optional if you want names on your user records. Use short attribute names; Google does not impose URI-style claim names the way Entra ID does.

Scope the app and turn it on

A newly created SAML app is off for everyone. Access is controlled by org unit or by group, and this is the control your customer's IT team will care about most.

1. 1Open User access on the app's page.
2. 2Turn the service on for the org units or groups that should reach your product, rather than for everyone.
3. 3Save and allow a few minutes. Google states that changes can take up to twenty-four hours to propagate, though in practice they are usually live in minutes.

Finish the connection in Paycux

1. 1Upload the IdP metadata file you downloaded to the Paycux connection.
2. 2If you skipped the download, copy the SSO URL, the entity ID and the certificate from the app's Google Identity Provider details screen instead.
3. 3Sign in as a user inside an enabled org unit and confirm the profile carries email, first name and last name.
4. 4Activate the connection.

Provisioning from Workspace

Google Workspace does not act as a general SCIM client for third-party apps in the way Okta or Entra ID do. Paycux connects to the Workspace directory instead, reading users, groups and org units directly and emitting the same directory events your application already handles.

The practical difference is what the customer grants: an admin authorises read access to their directory rather than pasting a token into a provisioning tab. The events your webhook receives are identical either way.

1{
2  "event": "dsync.user.created",
3  "data": {
4    "id": "directory_user_01HQZX8N4T",
5    "directoryId": "directory_01HQZX8N4T",
6    "organizationId": "org_01HQZX8N4T",
7    "idpId": "114982176451093820174",
8    "firstName": "Avery",
9    "lastName": "Lindqvist",
10    "emails": [{ "primary": true, "value": "avery@foo-corp.example" }],
11    "state": "active",
12    "customAttributes": { "orgUnitPath": "/Engineering" }
13  }
14}

When it does not work

Related