​
Prerequisites

  • A Google Workspace account with admin access
  • A verified domain in Google Workspace
  • Admin access to LowerPlane Settings

​
Setup Steps

1

Create OAuth credentials in Google Cloud

  1. Go to the Google Cloud Console.
  2. Create or select a project.
  3. Navigate to APIs & Services > Credentials.
  4. Click Create Credentials > OAuth 2.0 Client ID.
  5. Select Web application as the application type.
  6. Set the Name to LowerPlane SSO.
2

Configure Redirect URI

In the OAuth client settings, add the Authorized redirect URI. Copy the Redirect URI shown on LowerPlane’s SSO settings page and paste it here.It will look like: https://api.lowerplane.com/api/v1/auth/sso/callback/oidc
The exact Redirect URI is displayed on the Settings > SSO page in LowerPlane. Always copy it from there to avoid typos.
3

Copy Client ID and Client Secret

After creating the OAuth client, Google will display:
  • Client ID (e.g., 123456789.apps.googleusercontent.com)
  • Client Secret
Copy both values.
4

Enter credentials in LowerPlane

In LowerPlane, go to Settings > SSO and select Google as your provider:
  • Client ID: Paste the Client ID from Google
  • Client Secret: Paste the Client Secret from Google
5

Configure domain restriction

Restrict sign-in to your organization’s email domain (e.g., @yourcompany.com). This prevents personal Google accounts from accessing your organization.
You can add multiple domains if your organization uses more than one (e.g., @company.com and @company.co.uk).
6

Enable SSO

Toggle SSO to Active. Users from your domain can now sign in with their Google Workspace accounts.

​
How It Works

  1. A user visits your LowerPlane login page and clicks Login with SSO.
  2. They enter their email address and LowerPlane detects the Google SSO configuration.
  3. The user is redirected to Google’s sign-in page.
  4. After successful authentication, Google sends an authorization code to LowerPlane’s redirect URI.
  5. LowerPlane exchanges the code for tokens, fetches the user profile, and logs the user in.

​
Configuration Details

SettingValue
ProtocolOAuth 2.0 / OpenID Connect
Authorization URLhttps://accounts.google.com/o/oauth2/v2/auth
Token URLhttps://oauth2.googleapis.com/token
Userinfo URLhttps://www.googleapis.com/oauth2/v3/userinfo
Scopesopenid, profile, email
Redirect URIShown on LowerPlane SSO settings page

​
Troubleshooting

Ensure the user’s Google Workspace account is part of your organization and has not been suspended. Personal Gmail accounts cannot be used for SSO.
The Redirect URI in Google Cloud Console must match exactly what is shown on LowerPlane’s SSO settings page. Copy it directly — even trailing slashes or HTTP vs HTTPS differences will cause failures.
The user must be added to your LowerPlane organization before they can sign in via SSO. Add them from Settings > Users.
Verify the domain is entered exactly as it appears in your Google Workspace admin console (e.g., yourcompany.com not www.yourcompany.com).