Configuring SSO with Google

Last updated: September 17, 2026

Plan availability

Business and Enterprise Scale only

Platform(s)

Web/Browser, Mac app, and Windows app 

Related reading

Set up Google SSO with an email attribute

Use this setup for a separate login identifier and email address, or to onboard external users. If you already have working SSO, start with Upgrade an existing SSO configuration. Basic email-NameID SSO instructions are in the collapsed section below.

  1. Open the Airtable SAML application in Google Workspace. You’ll need access to its SAML settings and your organization’s Airtable SSO settings, including a verified domain for the configuration.

  2. In the custom SAML app, add an attribute mapping from Basic Information → Primary Email (or the field containing the intended Airtable email) to the app attribute mail. Keep the existing first- and last-name mappings if you use them.

  3. Choose a stable, unique NameID. For a non-email identifier, use Unspecified as its format. If you keep an email or UPN as the identifier, confirm whether that value will change during email or domain changes.

  4. In Airtable, enter the IdP’s sign-in URL and X.509 certificate. Select V2, set Email attribute name to the exact outgoing attribute name from step 2, and save. See the Airtable setup instructions.

  5. Copy the two values from the saved Airtable configuration into Google Workspace:

    Airtable field

    Google Workspace field

    Reply URL (ACS)

    ACS URL

    Audience URI (Entity ID)

    Entity ID

    Use the configuration-specific pair. Don’t combine the new ACS URL with a legacy Entity ID. If your IdP validates Airtable’s signed requests, use the corresponding V2 Airtable metadata/certificate.

  6. Assign a test user and launch Airtable from the IdP. Complete any email confirmation and linking steps, then confirm the correct email and existing account content. Test Sign in with Single Sign On from Airtable as well.

  7. Decide whether to turn on SSO required after testing. It is not required to enable SSO. For external users, follow the onboarding steps; the first unlinked sign-in starts from the IdP.

If your preconfigured app doesn’t expose the required attribute and endpoint settings, contact Airtable Support before changing an existing integration. If you use SCIM, preserve provisioning and align its userName mapping with the SAML NameID as part of the upgrade.

Basic Google SSO with the legacy ACS URL

Use this path when the NameID is each user’s Airtable email address. Leave Email attribute name at Use NameID (default).

Use https://airtable.com/auth/ssoCallback as the ACS URL and the legacy Entity ID shown in the saved configuration: 

  • https://airtable.com/sso/metadata.xml for V1

  • or https://airtable.com/sso/metadata0418.xml for V2

Setting up SSO for Google prerequisites

Adding custom SAML apps is only available to super admins or users with admin accounts that include:

  • Apps > Web and mobile apps > Manage SAML apps - Allows admins to create, configure, and delete custom SAML apps.

  • (Optional, but recommended) User access management - Required to to assign apps to users or groups.

To confirm or create a custom role with the required permissions in your Google Admin console:

  1. Open your Google Admin console.

  2. Click Account.

  3. Click Admin roles.

Setting up SSO for Google

  1. Open your Google Admin console.

  2. Click Apps, then Web and mobile apps.

  3. Click Add app, then Add custom SAML app.

  4. Name your app.

    1. (Optional) upload the Airtable logo and add a description.

  5. Download the IdP metadata and note and copy the SSO URL/Sign-in page URL.

    1. This info is required for the admin panel at a later point.

    2. If you can't download the metadata, copy the following:

      1. SSO URL/Sign-in page URL

      2. Entity ID

      3. Certificate (x509 cert)

  6. Enter the following information in the corresponding fields:

    • ACS URL: the ACS URL shown in your Airtable SSO configuration dialog. For legacy configurations, use https://airtable.com/auth/ssoCallback.

    • Entity ID: the Entity ID shown in your Airtable SSO configuration dialog. For legacy configurations, use https://airtable.com/sso/metadata0418.xml.

    • Start URL: Leave blank

    • Signed Response: Leave unchecked

    • Name ID Format: Email

    • Name ID: Basic Information > Primary Email

      If your organization uses a non-email identifier as the Name ID, configure the email attribute in Airtable’s SSO settings so Airtable reads each user’s email address from the SAML attribute you specify — see SSO dependencies for more information.

  7. Click Add mapping and map these fields:

    1. App Attribute (SAML Attribute) > Google Directory Attribute

    2. urn:oid:2.5.4.4 > Basic Information > Last Name

    3. urn:oid:2.5.4.42 > Basic Information > First Name

  8. Submit your sign-in URL and x509 certificate, following the steps in Configuring SSO in the admin panel article.

FAQs

If another team in my company already uses SSO with Airtable, how does this impact my Business or Enterprise Scale account?

In Airtable, our system expects Enterprise Scale accounts using shared domains — domains federated to multiple Enterprise accounts — to use the same SAML metadata for SSO. What this means is that if your company has existing Enterprise Scale accounts with SSO configured, you will need to coordinate with the admins (or IT department) of the other accounts to obtain the current sign-in URLs, x.509 certificates, and ensure that your users have the necessary access to the Airtable tenant present in your company’s identity provider.

You can configure separate tenants or identity providers for domains unique to Enterprise Scale accounts, as each domain can be configured with its own SAML metadata.