> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Google Directory OAuth 2.0 connector profile – StackOne setup guide > Set up the OAuth 2.0 connector profile for Google Directory in StackOne. One-time admin setup required before your users can link Google Directory accounts via Hub. Super Admin or Admin privileges in Google Workspace are required to complete this setup.
Select Actions to adjust the guide
Some actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.
Action
Scope(s)
Loading actions...
Dynamic Guide URL
Scopes Selected

          

            
Separator

Create or select a Google Cloud project

To use Admin SDK API with OAuth 2.0, you need a Google Cloud project.

Sign in to your Google Cloud Console.

Select an existing project from the dropdown at the top of the page, or create a new one by clicking New Project and filling in the Project name, Organization, and Parent resource fields, then clicking Create.

Enable the Admin SDK API

Enable the Admin SDK API for your project. This step is required whether you created a new project or selected an existing one.

In the Google Cloud Console, navigate to APIs & Services > Library.

Search for "Admin SDK API", click on it.

  • New project: Click Enable to activate the API.
  • Existing project: If the API is already enabled, the button will show Manage. If it shows Enable, click it to enable the API.

Configure Google Auth Platform

Before creating OAuth credentials, ensure Google Auth Platform is configured.

In the Google Cloud Console, go to APIs & Services > OAuth consent screen. This will open the Google Auth Platform dashboard.

If you have already configured Auth Platform (the OAuth Overview page with usage metrics is shown), skip this step and navigate to the Branding page from the sidebar. Otherwise, you will see a Get started button — click it to begin the configuration process.

Fill in the required fields for your application.

  • App name: Enter a name for your application (e.g., StackOne Integration).
  • User support email: Select an email for user inquiries.
  • Click Next to continue.

Choose the appropriate user type for your application.

  • Internal: Only users within your Google Workspace organization can authorize (no app verification required).
  • External: Any Google account can authorize (requires app verification for production use).
  • Click Next to continue.

Provide email addresses for Google to notify you about any changes to your project. Click Next to continue.

Review your settings, agree to the Google API Services User Data Policy, and click Create to complete the setup.

Configure scopes

In Google Auth Platform, go to Data Access and click Add or Remove Scopes to configure the OAuth scopes your application needs.

Enables actions: Add Member To Group, Check Member Existence, Create Domain, Create Group, Create Organizational Unit, Create User, Delete Domain, Delete Group, Delete Organizational Unit, Delete User, Get Domain, Get Group, Get Member, Get Organizational Unit, Get Unified Group, Get Unified Organization, Get Unified Role, Get Unified User, Get User, List Domains, List Groups, List Members, List Organizational Units, List Unified Groups, List Unified Organizations, List Unified Resource Types, List Unified Resource Users, List Unified Roles, List Unified Users, List Users, Patch Group, Patch Member, Patch Organizational Unit, Patch User, Remove Member From Group, Update Group, Update Member, Update Organizational Unit, Update User

Add scopes based on the Google Directory resources you need to access. Each resource has a read-write scope for full management and a read-only scope for read-only access.

  • User management (list, get, create, update, delete users): `https://www.googleapis.com/auth/admin.directory.user` or `admin.directory.user.readonly` for read-only
  • Group management (list, get, create, update, delete groups): `https://www.googleapis.com/auth/admin.directory.group` or `admin.directory.group.readonly` for read-only
  • Organizational unit management (list, get, create, update, delete org units): `https://www.googleapis.com/auth/admin.directory.orgunit` or `admin.directory.orgunit.readonly` for read-only
  • Domain management (list, get domains): `https://www.googleapis.com/auth/admin.directory.domain` or `admin.directory.domain.readonly` for read-only
  • Connection identity (unified\_get\_me): `https://www.googleapis.com/auth/userinfo.email` — populates the email/name on the IAM credentials record. Without this scope the name field is null.

In the Update selected scopes side panel that opens, check the required scopes from the list.

If a required scope is not shown in the list, use the Manually add scopes section.

  • Enter the full scope URL in the input field.
  • Click Add to table.

Confirm and persist your scope configuration.

  • Click Update to apply the selected scopes. The side panel will close.
  • On the Data Access page, click Save to persist the scope configuration.

Adding the correct OAuth scope is necessary but not sufficient for user management actions. If you receive a 403 Forbidden error when running actions such as listing or getting users, this indicates the Google account used to authorize the connection does not have the required admin role in Google Workspace.

The Google Directory API requires the authenticated account to have Super Admin or an appropriate Delegated Admin role in your Google Workspace organization. To resolve this, ensure the account used to connect is assigned the Super Admin role or the relevant delegated admin privilege in the Google Admin Console.

Create OAuth 2.0 client credentials

Set up OAuth client credentials to authenticate with Admin SDK API. If you already have an existing OAuth 2.0 client, you can reuse it by adding the StackOne redirect URI and generating a new secret.

In the Google Cloud Console, go to APIs & Services > Credentials.

Skip this step if you are using an existing client.

  • Click + Create Credentials and select OAuth client ID.
  • Select Web application as the application type.
  • Enter a Name for your OAuth client (e.g., StackOne Directory Integration).
  • Under Authorized redirect URIs, click Add URI and enter `https://api.stackone.com/connect/oauth2/googledirectory/callback`.
  • Click Create. A dialog will display your Client ID and Client Secret — copy and store them securely.

Skip this step if you created a new client above.

  • Click on your existing OAuth 2.0 client ID from the list.
  • Under Authorized redirect URIs, click Add URI, enter `https://api.stackone.com/connect/oauth2/googledirectory/callback`, and click Save.
  • Under Client secrets, click + Add secret to generate a new secret. Copy it and store it securely — it will not be shown again.
  • Your Client ID is shown on the same page under Additional information.
## Creating the StackOne Connector Profile To create the Connector Profile in StackOne for Google Directory: Login to StackOne and navigate to [Connector Profiles](https://app.stackone.com/connector_profiles)
  • Click + Connector Profile
  • Search for and select Google Directory
  • Select Type as OAuth 2.0
  • Fill out the fields using details retrieved from your provider:
    • Client ID
    • Client Secret
    • Scopes (Optional)
  • (Optional) Select Actions to be enabled for this Connector Profile
  • Click Create profile
 Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to Link Accounts for Google Directory.