Google Workspace

Google requires domain-wide delegation for Trustle to securely access your Google Workspace data. Domain-wide delegation lets Trustle act on behalf of users in your organization without requiring each user to individually grant permissions. This lets Trustle automate user management for your organization through the standard Google APIs.

Prerequisites

• Your organization’s Google Workspace Customer ID, for Trustle.
• The email address of a Super Admin in your Google Workspace, for Trustle.
• The Client ID and OAuth Scopes in this guide, for the Google Admin console.

Configure Google Workspace

Step 1: Locate Your Google Workspace Customer ID

The Customer ID is a unique identifier for your Google Workspace organization. Trustle needs it to configure this integration.

1. Sign in to the Google Admin Console with your super administrator account.
2. In the Admin console, click Account in the left sidebar, then click Account settings.
3. Find the Customer ID field in the Account details section. It’s a string of characters like C01abc234 or C03xyz789.
4. Copy this ID. You enter it into the Trustle UI.

Note

The Customer ID ensures Trustle connects to the correct Google Workspace organization, and helps with audit logging and security.

Step 2: Identify Your Super Administrator Email

Trustle needs the email address of a super administrator account for initial configuration and ongoing administrative tasks.

1. In the Google Admin Console, go to Directory → Users.
2. Find your account, or the account you want to use, and click it to view its details.
3. Under Admin roles and privileges, confirm it shows Super Admin.
4. Record the complete email address, for example admin@yourcompany.com. Use an account that stays active and accessible.

Note

The super admin email is required for certain high-privilege operations.

Step 3: Enable Required APIs

Before you set up delegation, enable the necessary Google APIs for your organization.

1. Go to the Google Cloud Console and sign in with your super administrator account.
2. Select or create a project for API management:
   1. Click Select a project at the top.
   2. Click New Project.
   3. Enter a name, for example “Workspace API Management”.
   4. Click Create.
3. In the Cloud Console, go to APIs & Services → Library.
4. Search for “Admin SDK API”.
5. Click it and select Enable.

Note

The Admin SDK API must be enabled so Trustle can interact with your Workspace data through the scopes you configure in Step 4.

Step 4: Configure Domain-Wide Delegation

This is the core step where you authorize Trustle to access your Workspace data.

1. Go back to the Google Admin Console.
2. Click Security in the left sidebar, select Access and data control, then click API controls.
3. Scroll down to Domain-wide delegation and click Add new (or Manage Domain Wide Delegation).
4. Enter the client information:
   • Client ID: Trustle’s unique identifier, 105511435084235295500.
   • OAuth Scopes: copy and paste the following scopes, one per line or comma-separated:
     • https://www.googleapis.com/auth/admin.directory.user
     • https://www.googleapis.com/auth/admin.directory.customer
     • https://www.googleapis.com/auth/admin.directory.group
     • https://www.googleapis.com/auth/admin.directory.group.member
     • https://www.googleapis.com/auth/admin.directory.orgunit
     • https://www.googleapis.com/auth/admin.directory.rolemanagement
     • https://www.googleapis.com/auth/admin.directory.user.security
     • https://www.googleapis.com/auth/cloud-identity.groups
5. Click Authorize, review the permissions summary, and confirm the authorization.

These scopes let Trustle do the following:

OAuth scope	Purpose
https://www.googleapis.com/auth/admin.directory.user	Read user information and manage user accounts.
https://www.googleapis.com/auth/admin.directory.user.security	Read user information and manage user accounts.
https://www.googleapis.com/auth/admin.directory.group	Read and manage groups and group memberships.
https://www.googleapis.com/auth/admin.directory.group.member	Read and manage groups and group memberships.
https://www.googleapis.com/auth/cloud-identity.groups	Read and manage groups and group memberships.
https://www.googleapis.com/auth/admin.directory.orgunit	Access and manage organizational units.
https://www.googleapis.com/auth/admin.directory.rolemanagement	Read and manage administrative roles.
https://www.googleapis.com/auth/admin.directory.customer	Read basic organization details.

Verify

1. In the Admin Console, go back to Security → Access and data control → API controls.
2. Under Domain-wide delegation, confirm your entry appears with:
   • The correct Client ID.
   • All required scopes listed.
   • Status showing as “Authorized”.
3. In the same section, confirm Admin SDK API appears in the list of enabled APIs.