Directory Sync · Setup guides

Google Workspace does not provide SCIM, so OrbitID connects to the Google Directory API instead and polls it for changes. Setup takes a minute and needs a Google Workspace super admin account.

Step 1: Create the directory

In the OrbitID dashboard open the environment, go to Directory Sync, click New directory and choose Google Workspace as the provider. Enter the tenant it belongs to and, optionally, a webhook URL and secret, then save.

Step 2: Connect Google

Open the directory's settings and click Connect. You are sent to Google's consent screen. Sign in with a Google Workspace super admin of the customer's domain and grant the requested access. OrbitID asks for read-only scopes only:

• admin.directory.user.readonly
• admin.directory.group.readonly
• admin.directory.group.member.readonly

After you accept, Google sends you back to OrbitID and the directory shows as connected. If your customer's admin should authorise instead of you, send them the directory's authorization link from the same settings page.

Step 3: Wait for the first sync

OrbitID imports all users and groups on the first run and emits user.created, group.created and group.user_added events for them. After that it polls Google on a schedule and emits user.updated, user.deleted, group.updated, group.deleted and group.user_removed events as the directory changes. See Webhooks for payloads.

Disconnect

Deactivate or delete the directory in OrbitID to stop syncing. The customer can also revoke OrbitID's access from their Google Admin console under Security → API controls.