Skip to main content

Google sign-in

Google sign-in and signup are available to all Quave ONE users. Use Continue with Google on the login or registration page. Your Google identity does not grant account access: invitations, membership and permissions are managed in Quave ONE.

An existing Quave ONE user is linked safely to the matching Google identity instead of creating a duplicate user. Gmail and verified Google Workspace identities can establish email ownership. For a third-party address without Google Workspace authority, an additional one-time email verification code is required. Existing Quave ONE authenticator/recovery-code requirements still apply.

Require Google sign-in for Workspace domains​

Account admins manage this on Members → Google Sign-in. Add exact Google Workspace domains one at a time, such as example.com. Email addresses, URLs, wildcards, public email-provider domains and Quave ONE domains (such as zcloud.ws) are not supported. Subdomains require a separate entry.

Prove you own each domain​

A domain is enforced only after your account proves it controls it, so nobody can lock out another organization's users.

  • Instant verification: if one of your app environments already has a custom host on that domain, or on a subdomain of it, and Quave ONE has confirmed that its DNS resolves to Quave ONE, the domain is verified as soon as you add it.

  • DNS TXT record: otherwise, Quave ONE shows a record to create at your DNS provider, then select Verify:

    NameTypeValue
    _quave-one-verification.example.comTXTquave-one-verification=<your token>

    Each account gets its own token, so several accounts can verify the same domain. Keep the record in place after verification.

The Require Google sign-in for these domains toggle can be turned on once at least one domain is verified. Pending domains have no effect. Removing the last verified domain turns the requirement off.

This setting has platform-wide consequences. Every user with a matching primary email domain must use Google to sign in anywhere in Quave ONE, including other accounts and users who are not members of the configuring account. All enabled account configurations combine; disabling one account's rule does not remove another account's restriction.

Turning the setting on, or adding or verifying a domain while it is on, displays a confirmation modal. Confirming logs out affected active sessions that were not authenticated with Google, including sessions whose original authentication method cannot be verified. They must sign in with their matching work Google Workspace account. Already-valid Google sessions remain active. A personal Google account registered with a corporate email is not sufficient.

Programmatic access is unchanged: this setting does not revoke or restrict CLI, API or MCP credentials.

Google account disablement is not automatic offboarding​

Disabling or removing a user in Google does not end an existing Google-authenticated Quave ONE session. Quave ONE checks Google during fresh authentication, not every request or session resume. Remove the member in Quave ONE to revoke access to that account; existing session expiration/inactivity policies continue to apply.

There is no directory/group synchronization, automatic provisioning or background Google revalidation. If Google sign-in is unavailable, a domain-enforced user cannot bypass the restriction with another login method.