Google Cloud Single Sign-On

Google Cloud provides OpenID Connect (OIDC) identity services that you
can use to bring your Google users into Uptrace.

Single Sign-On allows you to manage users using OIDC providers. After logging in, such users are
automatically added to a team and can access team projects. When users are removed from Google, they
automatically lose granted access in Uptrace.

Step 1. Create OIDC SSO in Uptrace

1. In Uptrace, go to Organization -> Single Sign-On
2. Click New SSO -> New Google (OIDC)
3. Fill out the form:
   • Domain: your unique domain name (can be any string; it will be used later during the sign-in
     process)
   • User team: select the team that will be automatically assigned to new users
   • User role: select the role that will be automatically assigned to new users

4. Click Create and you will be presented with the redirect URL to configure Google OAuth

Leave this form open — you will need to enter the Client ID and Client Secret from Google to
finish the setup.

Step 2. Create Google OAuth client

1. Visit Google Cloud Console and open APIs & Services
2. Open the Credentials tab and click Create credentials -> OAuth client ID
3. Set Application type to Web application
4. Under Authorized redirect URIs, add the redirect URL you received from Uptrace in Step 1
5. Click Save and you will be presented with the Client ID and Client Secret

Step 3. Finish configuring Uptrace

1. Go back to the OIDC SSO form you left open in Step 1
2. Enter the Client ID and Client Secret you received from Google in Step 2
3. Click Save

You can now log in to Uptrace using Google by opening
https://uptrace.dev/auth/sso/<your-domain>.

Troubleshooting

Redirect URI mismatch — The redirect URI configured in Google Cloud must exactly match what
Uptrace uses. Make sure the protocol (http vs https), host, and port all match.

User has no email — Uptrace requires an email address for SSO users. Google accounts always have
an email, so this is typically not an issue.

OAuth consent screen not configured — If you see an error about the consent screen, make sure you
have configured the OAuth consent screen
in Google Cloud Console before creating the OAuth client.