Skip to main content

Set up 5Mins sign-in with Google Workspace

Once this is set up, everyone with a company email address signs in to 5Mins through Google, so your Google Workspace 2-Step Verification protects every 5Mins login. Your Google admin makes two changes in Google, sends us a few details, and we switch it on.

How sign-in works

Once Google sign-in is switched on, Google checks every 5Mins login for your email domain.

  1. The person enters their work email on the 5Mins sign-in page, on the web or in the 5Mins mobile app.

  2. 5Mins recognises your company's email domain and sends them to Google.

  3. Google checks their password and 2-Step Verification, just as it does for Gmail or Drive. If they're already signed in to Google, it may only ask them to pick their account.

  4. Google sends them back to 5Mins, signed in.

Existing 5Mins accounts are matched by email address, so learning history and certificates stay in place. Anyone signing in for the first time gets a 5Mins account automatically.

Before you start

You need two kinds of Google access, and your team's 5Mins accounts must use your company email addresses.

  • A Google Workspace super administrator, to change the 2-Step Verification setting.

  • Someone who can create a project in your Google Cloud organisation, to create the sign-in app. The project must sit under your organisation, or Google won't offer the Internal option that limits sign-in to your own staff.

  • Company email addresses on Google Workspace (for example name@yourcompany.com). Personal @gmail.com addresses can't use this setup.

Step 1: Turn on 2-Step Verification in Google Workspace

Skip this step if 2-Step Verification is already enforced for everyone who uses 5Mins.

  1. Ask your team to turn on 2-Step Verification for their Google accounts before you enforce it. You can check who has enrolled under Reporting > User reports > Security.

  2. Sign in to the Google Admin console as a super administrator.

  3. Go to Menu > Security > Authentication > 2-step verification. To apply it to only some people, pick an organisational unit or group on the left first.

  4. Tick Allow users to turn on 2-Step Verification.

  5. Under Enforcement, choose On, or Turn on enforcement from date to give people notice. A dated start can take 24 to 48 hours to apply.

  6. Set a New user enrollment period (for example 1 week) so new starters have time to set up their second step.

  7. Under Methods, choose which second steps people can use. If you choose Any except verification codes via text, phone call, warn anyone who relies on text codes first, or they'll be locked out.

  8. Click Save.

Step 2: Create the 5Mins sign-in app in Google Cloud

This creates a private sign-in app that only people in your organisation can use.

  1. Open the Google Auth Platform. When asked, create a new project (for example "5Mins sign-in") under your organisation.

  2. Click Get started and fill in:

    • App name: 5Mins

    • User support email: your IT support address

    • Audience: Internal

    • Contact information: the address that should get Google's notices about this project

  3. Agree to the Google API Services User Data Policy, then click Continue and Create.

  4. Open Clients and click Create client.

  5. For Application type, choose Web application and name it 5Mins.

  6. Under Authorized redirect URIs, add exactly https://login.5mins.ai/__/auth/handler

  7. Click Create.

  8. Copy the Client ID and Client secret straight away, or download the JSON file. Google shows the full secret only once. If it's lost, you'll need to generate a new one.

You don't need to add anything under Data Access. 5Mins only asks Google for each person's name and email address.

Step 3: Send us the details

Send these four details to your 5Mins contact.

Detail

Notes

Client ID

From Step 2. It ends in .apps.googleusercontent.com

Client secret

From Step 2. Send it separately, through a password manager share or a one-time secret link, never in plain email

Email domains

Every domain your team's 5Mins accounts use, for example yourcompany.com and yourcompany.co.uk

Test user

One person with a company email address who can help us test before switch-on

Switch-on

We set up Google sign-in on your 5Mins account and test it with your test user before anyone else is affected. Once it works, we agree a switch-on date with you.

From that date:

  • When people with your email domain sign in, 5Mins sends them to Google instead of asking for a 5Mins password.

  • People with other email domains, such as contractors, keep signing in as they do now.

  • If you ever need to pause it, we can switch it off on our side.

If something goes wrong

What the person sees

Fix

Error 403: org_internal

They're signed in to a Google account outside your organisation, such as a personal Gmail account. Switch to their work account and try again.

Error 400: redirect_uri_mismatch

The redirect URI in Step 2 doesn't exactly match https://login.5mins.ai/__/auth/handler. Correct it. Google can take from 5 minutes to a few hours to apply the change.

Google doesn't ask for a second step

2-Step Verification isn't enforced for that person yet, they're still in their new user enrollment period, or they've trusted their device. Check Step 1.

Sources

Was this helpful?

Still need help? Ask the team