# Google Workspace + Lutril: setup guide

> Lutril authenticates as a Google Cloud service account with domain-wide delegation, so it can read and manage your Workspace directory on behalf of a Workspace admin. You provide the service account JSON key and the admin email.

Source: https://www.lutril.com/integrations/google
Category: Identity (IDP)
Auth: service_account
Last verified: 2026-06-17

---

## Setup

1. [object Object]
2. Select the new service account, open Keys, click Add key, choose Create new key, and pick JSON. Paste the entire downloaded JSON file into Lutril.
3. On the service account, open advanced settings and copy its Client ID (a numeric Unique ID used for delegation).
4. [object Object]
5. Click Add new, paste the Client ID, enter the comma delimited list of OAuth scopes shown above, then click Authorize. If an entry for this Client ID already exists, edit it to include every scope above and click Authorize again. Adding a scope to an existing entry does not take effect until it is re-authorized, and a missing admin.datatransfer scope is what silently blocks the offboarding data transfer.
6. Enter a Workspace admin email (a super admin authorized for these scopes) in Lutril so calls are made on that admin's behalf.

## Access requested

- https://www.googleapis.com/auth/admin.directory.user
- https://www.googleapis.com/auth/admin.directory.user.alias
- https://www.googleapis.com/auth/admin.directory.user.security
- https://www.googleapis.com/auth/admin.directory.group.member
- https://www.googleapis.com/auth/admin.directory.group.readonly
- https://www.googleapis.com/auth/admin.reports.audit.readonly
- https://www.googleapis.com/auth/admin.reports.usage.readonly
- https://www.googleapis.com/auth/admin.datatransfer
- https://www.googleapis.com/auth/gmail.send

## References

- [Google Workspace documentation](https://developers.google.com/admin-sdk/directory/v1/guides/delegation)
- [Google Workspace console](https://console.cloud.google.com/iam-admin/serviceaccounts)
- [Domain-wide delegation guide](https://developers.google.com/admin-sdk/directory/v1/guides/delegation)
- [Control API access with domain-wide delegation](https://support.google.com/a/answer/162106)