Skip to content
Cloudflare Docs
Access
Cloudflare Docs
Access
Search icon (depiction of a magnifying glass)
GitHub icon
Visit Access on GitHub
Set theme to dark (⇧+D)

Google

You can integrate Google authentication with Cloudflare Access without a Google Workspace account. The integration will allow any user with a Google account to login (if the Access policy allows them to reach the resource). Unlike the instructions for Google Workspace, the steps below will not allow you to pull group membership information from a Google Workspace account.

  1. Visit the Google Cloud Platform console. Create a new project.

Create Project

  1. Name the project and click Create.

Name Project

  1. On the project home page that loads, select APIs & Services from the sidebar and click Dashboard.

Name Project

  1. You will first need to configure a consent screen. Click Configure Consent Screen at the top of the page.

Click Consent

  1. Choose External as the User Type. Since this application is not being created in a Google Workspace account, the only types of users are external.

Choose External

  1. Name the application and add a support email (GCP will require you to add an email in your account).

Name App

You will also be prompted to input contact fields.

Contact Fields

  1. In the Scopes section, we recommend adding the userinfo.email scope. This is not required for the integration to work, but will indicate to users authenticating what information is being gathered.

Scopes

You do not need to add test users.

Test Users

You can review the summary information and return to the dashboard at the bottom of the page.

Summary

  1. Return to the APIs & Services page and click + Create Credentials. Select OAuth client ID.

Create OAuth

  1. Name the application.

Name OAuth

  1. You will need to input your Cloudflare authentication domain. The domain will be structured in the following format:
https://<your-auth-domain-here>.cloudflareaccess.com

Input the authentication domain without any path in the Authorized JavaScript origins section. In the Authorized redirect URIs section, input your authentication domain with the path below.

https://<your-auth-domain-here>.cloudflareaccess.com/cdn-cgi/access/callback

Auth Domain

  1. Google will present the OAuth Client ID and Secret values. The secret field functions like a password and should be kept securely and not shared. For the purposes of this tutorial, the secret field is kept visible. Copy both values.

Secret Field

  1. Navigate to the Cloudflare for Teams dashboard. In the Authentication page of the Access section, click + Add.

Add IdP

  1. Select Google.

Add Google

  1. Input the Client ID and Client Secret fields generated previously. Click Save.

Add Google Suite

  1. You can now return to the list of identity providers in the Authentication page of the Cloudflare for Teams dashboard. Select Google Suite and click Test.

Your user identity should return.

Connection Works

Example API Config

{    "config": {        "client_id": "<your client id>",        "client_secret": "<your client secret",    },    "type": "google",    "name": "my example idp"}

export const _frontmatter = {"order":12}