Configure Google sign-in
Link Google identities to invited managed users while keeping explicit Sparta roles and mandatory authenticator verification.
Configure the client
- Create a Google OAuth Web application client.
- In Settings → Users and roles → Google sign-in, copy the exact callback shown for this installation.
- Register that HTTPS callback in Google. Its path is /api/auth/google/callback.
- Save the client ID and secret in Sparta.
- Test an invited user's sign-in and authenticator step.
Configure the Google consent screen and organization policies separately.
Account linking
Google sign-in does not create Sparta users or assign roles from an email domain. Invite each person first.
For external addresses that Google does not authoritatively control, accept the invitation and sign in with the Sparta password and authenticator first. Link Google from Account security within the recent-authentication window, retaining the same browser session.
A linked Google identity does not replace Sparta's authenticator requirement. Changing or disabling the client invalidates pending callbacks.
For evidence collection from the directory, configure the separate Google Workspace integration.
Manage account security
Operate managed passwords, mandatory authenticators, session expiry and administrator-assisted recovery without bypassing identity checks.
Operate an Access-mode installation
Distinguish legacy Cloudflare Access authentication from managed accounts and preserve private API and public publication boundaries during migration.