Set Up Google Workspace Single Sign-On (OIDC) for SparkToro

SparkToro supports Single Sign-On using OpenID Connect (OIDC) with Google Workspace. Once configured, your team signs in to SparkToro with their Google Workspace credentials, and new users are provisioned automatically on first sign-in up to your account's seat limit.

Supported Features

This integration supports the following features:

• SP-Initiated SSO: users start at SparkToro's sign-in page (https://sparktoro.com/account/login/sso) and authenticate with Google.
• Just-In-Time (JIT) Provisioning: new users are created in SparkToro automatically on their first successful sign-in, up to the account's seat limit.

Prerequisites

• A SparkToro account on an Agency plan with Single Sign-On included.
• Google Workspace administrator access to the Google Cloud Console.
• You are the owner of the SparkToro account. Single Sign-On is configured by the account owner.
• Each user has an email address on their Google Workspace profile. SparkToro requires an email address from your identity provider to sign a user in.

Step 1: Configure the OAuth consent screen

1. In the Google Cloud Console, select or create a project for this integration.
2. Go to APIs & Services > OAuth consent screen.
3. Set the User type to Internal so only users in your Google Workspace organization can sign in.
4. Complete the app name and support contact fields, then save.

Step 2: Create an OAuth client

1. Go to APIs & Services > Credentials.
2. Click Create Credentials > OAuth client ID.
3. Set Application type to Web application.
4. Under Authorized redirect URIs, add: https://sparktoro.com/account/google/callback
5. Click Create, then copy the Client ID and Client secret.

Step 3: Enter the credentials in SparkToro

1. In SparkToro, go to Account > Settings > Single Sign-On.
2. Select Google Workspace as your identity provider.
3. Enter the following:
   • Issuer URL: https://accounts.google.com
   • Client ID and Client Secret from Step 2.
4. Add your Google Workspace email domain (for example yourcompany.com). Public email domains such as gmail.com cannot be used.
5. Click Test Connection. SparkToro validates the issuer's discovery document.
6. Click Save and Enable SSO.

After you enable SSO, SparkToro enforces it for users on your verified email domain. The account owner keeps password access as a fallback so you are never locked out of billing.

Signing in

Users go to https://sparktoro.com/account/login/sso, enter their work email, and authenticate with Google. New users are provisioned automatically on first sign-in (just-in-time), up to your account's seat limit.

Reference

• Sign-in redirect URI: https://sparktoro.com/account/google/callback
• Issuer URL: https://accounts.google.com
• Scopes: openid, email, profile

Support

If you have questions or need to enforce SSO across more than one email domain, email support@sparktoro.com.