TimeLeaf works with Google Workspace in four ways: employees sign in with their Google account, employees are imported from your Google directory, approvers get leave requests in Google Chat, and approved leave appears on Google calendars.
What you need
| Part | Plan | Google rights |
|---|---|---|
| Sign in with Google (single sign-on) | Professional and above | A Google Cloud project where you can create OAuth credentials |
| Directory sync | Professional and above | A Google Workspace super admin to authorize a service account |
| Google Chat approvals | Every plan | A Google Cloud project where you can create a Chat app |
| Employees' own Google calendars | Professional and above (uses the sign-in app) | Google Calendar API enabled in the same project |
| Calendar feed (subscribe from Google Calendar) | Professional and above | None |
You also need to be a TimeLeaf admin, and your company must use Google Workspace; personal Gmail accounts can't be used. Integrations › Connected Apps shows the Google Workspace card with the status of each part and a link to its settings page.
Set up sign-in with Google
Create OAuth credentials
In Google Cloud Console, select or create a project and go to APIs & Services › Credentials › Create Credentials › OAuth client ID. If asked, set up the OAuth consent screen first: User Type: Internal, your app name and contacts, and the scopes openid, profile and email.
Choose Web application
Set Application type to Web application and give it a name. Leave the redirect URIs for now and click Create. Copy the Client ID and Client Secret from the dialog.
Add the provider in TimeLeaf
In TimeLeaf, go to Integrations › Single Sign-On and click Add Provider. Choose Google Workspace as the Provider Type, and fill in a Display Name, the Client ID, the Client Secret and your Workspace Domain (for example company.com). Tick Set as active provider and save.
Add the redirect URIs in Google
Open the saved provider with Edit and copy both Redirect URIs. In Google Cloud, edit the OAuth client and add both under Authorized redirect URIs. They look like:
https://<your-workspace>.timeleaf.io/api/auth/sso/callback/<provider id>(sign-in)https://<your-workspace>.timeleaf.io/api/me/calendar/callback(employees' own calendars)
Test it
Sign out and use "Sign in with Google" on the sign-in page.
Only accounts in your Google Workspace domain can sign in. A personal Google account is refused, even one created with an address on your domain.
To require everyone to use Google sign-in, see Single Sign-On.
Import employees from Google Workspace
Google sign-in can't list other people, so directory sync uses a Google Cloud service account with domain-wide delegation. You create it, authorize it in the Google Admin console with the scope https://www.googleapis.com/auth/admin.directory.user.readonly, and paste its key into Directory Sync Settings on People › Employees & Teams. Suspended and archived users are skipped, the sync runs again every day, and people who leave are archived. The full guide is Directory Sync.
Google Chat approvals
Approvers get leave requests as cards in Google Chat with approve and decline buttons, and employees can send commands to the bot. Google Chat uses its own Chat app and service account. See Google Chat.
Approved leave on Google calendars
Go to Integrations › Calendar Sync.
- Employees' own calendars. With Let employees connect their own calendar on (the default), each employee can connect their Google calendar from their own Settings › Profile, and their approved time off is added to it. Nobody is connected until they do it themselves. It uses your sign-in OAuth client, so enable the Google Calendar API in that Google Cloud project and add the calendar redirect URI from step 4.
- Calendar feed. With Let employees subscribe to a calendar feed on (the default), each employee can make a private link under Settings › Profile and subscribe to it in Google Calendar. It shows their own approved time off with its type, and their team's approved time off only as "Out".
A shared company Google calendar is not supported.
Troubleshooting
| Problem | What to do |
|---|---|
| Sign-in fails with a redirect error | The authorized redirect URI in Google must match the one on the provider's Redirect URIs exactly. |
| A person can't sign in with Google | Their account must be in your Workspace domain. Personal Google accounts are always refused. |
| No Sync Directory button on Employees & Teams | Google sign-in must be set up and active first. |
| Connecting a personal Google calendar fails | Enable the Google Calendar API in the sign-in project and add the calendar redirect URI. |