Skip to main content
The Google Workspace integration syncs users, groups, and OAuth app activity. No Google Cloud project required — the connecting super-admin signs in once and grants admin consent.

​
What you’ll need

  • Google Workspace Super Admin role (or a custom admin role with Reports and Directory read access).
  • Two minutes.

​
Set it up

1

Open the Google Workspace integration in Layer

In Layer, go to Integrations, find Google Workspace, and click Connect.
2

Sign in with your super-admin account

You’ll be redirected to Google’s sign-in screen. Use the super-admin account for the Workspace tenant you want to connect.
3

Grant admin consent

Google will show the requested scopes and ask for admin consent on behalf of the entire tenant. Click Allow.Scopes requested:
  • admin.directory.user.readonly — list users
  • admin.directory.group.readonly — list groups and membership
  • admin.reports.audit.readonly — read audit logs to discover OAuth app installs
4

Wait for the first sync

The initial sync runs immediately and typically finishes in 10–30 minutes depending on directory size.

​
What gets synced

ObjectFieldsRefresh cadence
Usersname, email, suspended state, last loginEvery 6 hours
Groupsname, description, member emailsEvery 6 hours
OAuth app grantsapp name, scopes, granting users, install dateDaily

​
Token refresh

Google access tokens expire approximately one hour after they are issued. Layer automatically refreshes tokens in the background each time a sync runs, so your connection stays active without any manual re-authorization. If a refresh fails — for example, because the admin revoked access in the Google Admin console — the connection status changes to needs re-auth and you can reconnect with one click.

​
Troubleshooting

Only Super Admins (or admins with the Reports and Directory roles) can grant the consent this integration needs. Sign in with a super-admin account.
This means Layer could not refresh the access token automatically. The most common cause is a revoked grant. Go to Integrations → Google Workspace and click Reconnect to re-authorize.
Go to Integrations → Google Workspace → Disconnect in Layer. To fully revoke, also remove Axiom from your tenant at admin.google.com/ac/owl/list?tab=apps.