> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sevalla.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These are the docs for Sevalla, a platform for deploying applications, databases, static sites, object storage and load balancers. The dashboard is at https://app.sevalla.com.
> Bold text in steps is an exact dashboard label.
> To act on a Sevalla account, prefer the Sevalla MCP server (https://mcp.sevalla.com/mcp, see https://docs.sevalla.com/ai-agents/overview.md), then the Sevalla CLI (https://docs.sevalla.com/developer-tools/cli.md), then the REST API (https://api-docs.sevalla.com, OpenAPI spec at https://api.sevalla.com/v3/openapi.json).
> Every page index is at https://docs.sevalla.com/llms.txt.

# Google Workspace

> Set up SAML single sign-on between Google Workspace and Sevalla: add a custom SAML app in the Google Admin console, map the attributes and turn the app on for your users.

Google Workspace is an identity provider (IdP) you can connect to Sevalla with SAML single sign-on (SSO). You add a custom SAML app in the Google Admin console with the values Sevalla shows, then paste Google's values into Sevalla. For how SSO works in Sevalla, see [Single sign-on](/company/single-sign-on/overview).

## Before you begin

* You're a company owner or admin in Sevalla.
* You can add apps in the Google Admin console (`admin.google.com`).
* Your Sevalla account uses an email address on your company's domain, and you have a Google Workspace user with the same address. The setup test signs you in with it.

## Values to copy

From Sevalla's **Create SAML app** step into Google:

| Google field | Sevalla value |
| - | - |
| **App name** | `Sevalla` (**App name**) |
| **App icon** | The Sevalla logo (**App icon** > **Download**) |
| **ACS URL** | `https://my.kinsta.com/saml/receive` (**SSO/ACS URL**) |
| **Entity ID** | `https://my.kinsta.com/saml` (**Entity ID**) |
| **Start URL** | `https://my.kinsta.com/login/saml` (**Start URL**) |
| **Signed response** | Selected |
| **Name ID format** | **EMAIL** |
| **Name ID** | **Basic Information** > **Primary email** |

From Google's **Google Identity Provider details** into Sevalla's **Sevalla setup** step:

| Sevalla field | Google value |
| - | - |
| **SSO URL** | **SSO URL** |
| **Entity ID** | **Entity ID** |
| **Public certificate** | **Certificate**: the contents of the downloaded file |

## Start the setup in Sevalla

<Steps>
  <Step title="Open the wizard">
    In the sidebar, under **Company**, click **Single sign-on**. On the **Single sign-on** card, click **Enable** (or **Continue setup**).
  </Step>

  <Step title="Go to the values">
    Click **Continue** to reach **Create SAML app**. Keep this tab open: you'll copy its values into Google.
  </Step>
</Steps>

## Create the SAML app in Google Workspace

<Steps>
  <Step title="Start a custom SAML app">
    In the Google Admin console, go to **Apps** > **Web and mobile apps**. Click **Add app** > **Add custom SAML app**.
  </Step>

  <Step title="Name the app">
    In **App name**, enter `Sevalla`. Optionally, add the description and upload the Sevalla logo in **App icon**. Click **Continue**.
  </Step>

  <Step title="Copy Google's details">
    Google now shows **Google Identity Provider details**. Copy the **SSO URL** and the **Entity ID**, and download the **Certificate**. You paste them into Sevalla in [Add the Google details to Sevalla](#add-the-google-details-to-sevalla). Click **Continue**.
  </Step>

  <Step title="Enter the service provider details">
    Fill in **ACS URL** (`https://my.kinsta.com/saml/receive`), **Entity ID** (`https://my.kinsta.com/saml`) and **Start URL** (`https://my.kinsta.com/login/saml`). Select **Signed response**. Set **Name ID format** to **EMAIL** and **Name ID** to **Basic Information** > **Primary email**. Click **Continue**.
  </Step>

  <Step title="Map the attributes">
    Click **Add mapping** for each row, then click **Finish**:

    | Google directory attributes | App attributes |
    | - | - |
    | **First name** | `firstName` |
    | **Last name** | `lastName` |
    | **Primary email** | `email` |
  </Step>
</Steps>

<Frame>
  <img src="https://mintcdn.com/sevalla/a3xHmYExJQcu1_oY/images/google-workspace/attribute-mapping.png?fit=max&auto=format&n=a3xHmYExJQcu1_oY&q=85&s=08cc349ea7c397cefb230211621c31be" alt="Google's attribute mapping with First name, Last name and Primary email mapped to firstName, lastName and email" width="2796" height="1952" data-path="images/google-workspace/attribute-mapping.png" />
</Frame>

## Give people access to the app

Only people with access to the app can sign in to Sevalla with Google Workspace. A new custom SAML app is off for everyone until you turn it on.

<Steps>
  <Step title="Open user access">
    In **Apps** > **Web and mobile apps**, click the Sevalla app, then click **User access**.
  </Step>

  <Step title="Choose who gets the app">
    Select **ON for everyone**, or pick the groups or organizational units that should have access and turn the app on for them. Click **Save**. Include yourself, so you can run the test.
  </Step>
</Steps>

## Add the Google details to Sevalla

<Steps>
  <Step title="Verify your email domain in Sevalla">
    In the Sevalla tab, click **Continue** to reach **Sevalla setup**. Under **Email domain**, add and verify your domain. See [Verify your email domain](/company/single-sign-on/overview#verify-your-email-domain).
  </Step>

  <Step title="Paste Google's values">
    Under **Set up Sevalla SAML**, paste:

    * **SSO URL**: Google's **SSO URL**
    * **Entity ID**: Google's **Entity ID**
    * **Public certificate**: the whole contents of the certificate file, including the `BEGIN CERTIFICATE` and `END CERTIFICATE` lines

    Click **Continue**.
  </Step>
</Steps>

## Test and set SSO live

On **Test and finish**, click **Test authentication** and sign in to Google. When Sevalla shows `Authentication test was successful.`, click **Save and set SSO live**. If the test fails, see [Troubleshoot SSO sign-in](/company/single-sign-on/overview#troubleshoot-sso-sign-in).

Next, you can [make SSO mandatory](/company/single-sign-on/overview#make-sso-mandatory) and [turn on just-in-time provisioning](/company/single-sign-on/overview#turn-on-just-in-time-provisioning).

## Change the session length

Google Workspace's session settings decide how long an SSO session lasts. If Google doesn't send a session end time, Sevalla's SSO session lasts 24 hours. To change it, see the [Google Workspace Admin Help article on session length](https://support.google.com/a/answer/7576830).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.