> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Google Workspace self-serve SSO setup
> Configure SAML-based single sign-on between Google Workspace and CodeRabbit from your organization's account management page.
export const EnterprisePlanBadge = ({tip = "This feature is available exclusively as part of the Enterprise plan. Please refer to our pricing page for more information about our plans and features.", title = "Enterprise Plan", cta = "Read more", href = "https://coderabbit.ai/pricing", disabled = false}) => {
return
{title}
;
};
export const AdminRoleBadge = ({tip = "This feature requires an organization owner, an admin role or the corresponding permission. Regular Members do not have access.", title = "Admin Only", cta = "View roles", href = "/management/roles", disabled = false}) => {
return
{title}
;
};
Use this guide to configure Google Workspace as the identity provider for your CodeRabbit Enterprise organization. The account management SSO wizard guides you through domain verification, Google Workspace SAML app setup, testing, and activation.
After SSO is activated, users with a verified email domain must sign in to CodeRabbit through Google Workspace.
## Before you start
Make sure you have:
* **Critical: You must have an invitation to your CodeRabbit organization from your CodeRabbit account team before starting this setup.**
* Organization admin access in the CodeRabbit account management page
* Access to the **Google Admin Console**
* Permission to create and configure custom SAML apps in Google Workspace
* Access to your DNS provider if your email domain still needs verification
* The users, groups, or organizational units that should be allowed to sign in through Google Workspace
If you do not see the **Security** section or the **Start configuration** button in your organization profile, contact your CodeRabbit account team. Your organization must be prepared for self-serve SSO before the account management SSO wizard appears.
## Set up Google Workspace self-serve SSO
Accept your CodeRabbit organization invitation and sign in to the account management page. Open the organization switcher, find the invited organization, and click **Manage**.
In the organization profile, select **Security**, and click **Start configuration**.
In **Domains**, enter the email domain that should use Google Workspace for CodeRabbit sign-in, then click **Add**.
If the wizard asks you to add a DNS record, add the generated `TXT` record in your DNS provider and wait for the domain to show **Verified** before continuing.
In **Connection**, select **Google Workspace** as the SAML identity provider.
The account management SSO wizard lists the Google Admin Console steps you need to complete.
In the Google Admin Console, go to **Apps** -> **Web and mobile apps**, click **Add app**, then select **Add custom SAML app**.
In **App details**, enter a clear app name such as `CodeRabbit`. The description and icon are optional.
In the Google custom SAML app setup, download the Google IdP metadata.
Return to the account management SSO wizard. In **Configure Google Workspace**, keep **Add via metadata** selected, upload the Google metadata XML file, and continue.
In the account management SSO wizard, copy the **ACS URL** and **Entity ID** values.
In the Google custom SAML app setup, paste the values into the matching fields:
| Google field | Value |
| --------------- | ----------------------------------------------------------------------- |
| ACS URL | Copy from the account management SSO wizard |
| Entity ID | Copy from the account management SSO wizard |
| Start URL | Leave blank |
| Signed response | Leave unchecked unless your CodeRabbit account team instructs otherwise |
| Name ID format | `EMAIL` |
| Name ID | `Basic Information > Primary email` |
The account management SSO wizard lists the attributes CodeRabbit expects from Google Workspace.
In the Google custom SAML app setup, add the following attribute mappings:
| Google directory attribute | App attribute |
| -------------------------- | ------------- |
| `Primary email` | `email` |
| `First name` | `firstName` |
| `Last name` | `lastName` |
After the custom SAML app is created, open its **Service status** settings and turn the app on for the users, groups, or organizational units that should be allowed to sign in to CodeRabbit.
The example below shows **ON for everyone**. Use the access scope that matches your rollout plan.
In **Test**, click **Open test URL** and complete the Google Workspace sign-in flow with a user who has access to the custom SAML app and whose email matches your verified domain.
Return to the account management SSO wizard and click **Refresh logs** until the latest test result shows **Success**. Do not activate SSO while the latest result is **Pending** or failed.
In **Activate**, review the activation message and click **Activate SSO**.
Activation changes sign-in behavior for the verified domain. After activation, users with that email domain must sign in to CodeRabbit through Google Workspace.
## What's next
Return to the SSO overview to understand how Enterprise SSO fits into your CodeRabbit rollout.
Pair SSO with the right access controls by reviewing how roles work in your CodeRabbit organization.
Contact CodeRabbit if the Security section is missing or the SSO test does not succeed.