Connect Google Workspace

#What you need

• A super admin of your Google Workspace.
• About five minutes.

#Steps

1. In your Google Admin console go to Security → Access and data control → API controls → Domain-wide delegation.
2. Click Add new and enter our service account's client ID (shown in the app under Directory → Google Workspace) with these scopes:
   • https://www.googleapis.com/auth/admin.directory.user.readonly
   • https://www.googleapis.com/auth/gmail.settings.basic
3. In WorkplaceSignatures open Directory → Google Workspace, enter the super admin's email (and optionally your primary domain), then Connect.
4. The first sync runs right away. After that we sync every 15 minutes.

The connection card shows a green dot and Active while syncs succeed, with the time of the last sync and a Sync now button. Recent sync runs at the bottom of the Directory page lists the last ten syncs with what each one changed (on a phone it shows as a timeline).

#Syncing only part of your organization

Enter one or more organizational unit paths (for example /Sales, /Marketing) to sync only those OUs. Everyone outside them is treated as not in the directory: no seat, no signature.

#What we access

• Read-only user data: name, email, title, department, phones, location, address (city, region, country), photo, manager, OU, suspension status.
• Gmail signature settings only (gmail.settings.basic). We never read email content.

#Profile photos

With Use directory photos on (the default, under Directory → Google Workspace), each sync copies people's Google profile photos into WorkplaceSignatures. Each one is cropped to a 256px square and hosted at a public link that mail clients can load. That copy fills {{photo_url}}. It needs no extra scope: admin.directory.user.readonly already covers photos.

• An admin headshot (Employees → person → Headshot) or the employee's own photo (self-service, when Photo URL is unlocked) always wins over the directory photo.
• Only changed photos are downloaded again. We compare Google's photo version (etag) and the image content, and photos are rechecked about once a day, a few hundred per sync, so a new photo can take up to a day to show.
• Removing a photo in Google removes it from the signature at the next check.
• Google stores small profile photos (around 96px), so they can look soft in larger photo blocks. Upload a headshot if you need a sharper one.
• The sync history table on the Directory page has a Photos column (on wider screens) showing how many photos each sync updated or cleared, plus any failures or throttling. It shows a dash when photos are off.
• Turn the setting off to stop copying photos. Stored copies are forgotten and signatures re-render right away.

#Groups

We do not read Google group membership yet, so a "Group" assignment rule or campaign target never matches for Google. Use Department, Org unit or a custom attribute to give teams their own signature. Group sync needs one more delegated scope, https://www.googleapis.com/auth/admin.directory.group.readonly; contact support if you need it.

#Suspended and deleted users

• Suspended in Google → their seat closes that day and their signature is removed.
• Deleted (or moved out of synced OUs) → archived: seat closed, data kept for history, zero cost.

As a safety net, a sync that would remove more than half of your people is refused (this protects you if permissions change and Google suddenly returns an empty list).