You must be an admin for the GSuite organization you are connecting to connect your GSuite account to Cloudflare.

Step 1: Begin by logging in to the Google Cloud console. This is a separate dashboard from your GSuite Admin console. You can use the link below to reach it for your account:

Step 2: Create a new GCP Project and title it ‘Cloudflare Access’. Ensure that the ‘Organization’ field matches your GSuite domain. gsnewproject

Step 3: Once created, you will be taken to the GCP project dashboard. Within the dashboard, find the card titled ‘APIs’ and select ‘Go to APIs overview’. gsdash

Step 4: In the sidebar to the left, click “Credentials” and click the button ‘Create credentials’ in the card on the Credentials screen. Select ‘OAuth client ID’ from the list.

Step 5: Click Create Credentials, and from the list select OAuth Client ID. gsdash

Step 6: On the next page, click the ‘Configure consent screen’ button and you’ll be asked to name the application in the following screen.

Step 7: Under ‘Application type’ select ‘Internal’. Input a name under ‘Application Name’. In the ‘Authorized domains’ field, you must input and click save.


Step 8: Clicking save will take you to a wizard to build the Application. Start by selecting ‘Web application’ from the available options and provide a name.


Step 9: For ‘Authorized JavaScript origins’ input the authentication domain from the Cloudflare Access admin dashboard. It will be in the format:

Step 10: Under ‘Authorized redirect URIs’, you will need to input the callback URI path, /cdn-cgi/access/callback for your authentication domain. For example:

Google will display a modal with your OAuth client ID and client secret. Copy those down, you will need these details in the GSuite Admin step and to complete your Cloudflare Access configuration.

Step 11: Now that you have created your application in GCP, you need to return to your GSuite admin account. You can reach the dashboard at and, once there, select ‘MORE CONTROLS’ at the bottom of the screen and click ‘Security’.


Step 12: Select the row ‘Advance Settings’ and click ‘Manage API client access’.


Step 13: In the Client Name field, input the Client ID you copied from the GCP modal. In the field ‘One or More API Scopes’ paste the following:,

Step 14: Click Authorize.


Once authorized, you can return to the Cloudflare Access dashboard and input your Client ID and Secret to complete the integration.

Step 15: In the Cloudflare configuration panel, make sure to input your Google domain with the TLD included. Select “Save and test” in the dashboard to confirm your configuration is working. If successful, click “Save and close.”