;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubManage users, groups and org units in a Google Workspace domain from any Windmill script, flow or app.
Set up in 2 steps
Connect from the Resources page
Open Resources, click Add a resource/API and pick gworkspace from the OAuth APIs list. Click Connect and sign in with a Workspace admin account, then name the resource and save it.
Run your first script
Fork any script below and read before writing anything.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Update User
Suspend or Unsuspend User
Reset User Password
Remove Group Member
Move User to Org Unit
List Users
List Org Units
List Groups
List Group Members
Get User
Get Access Token (Service Account)
Delete User
Create User
Create Group
Add Group Member
Google native trigger template script
Flows
Multi-step workflows that already wire Google Workspace to something else.
Resource type
The shape of the credential every script on this page expects.
gworkspace
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| token | string | Yes | OAuth token |
Questions
What can Windmill do with my account?
It acts through the Admin Directory API, so it can read and change directory objects across the domain. Connect an account with the admin rights you intend, and no more.
Can I create the resource by hand instead of connecting?
Nothing stops you, since the resource is a single token field. But Google's access tokens last about an hour, and only the OAuth flow returns the refresh token that renews them. For unattended automation without a person's OAuth session, use a service account instead (next question).
Can I use a service account with domain-wide delegation?
Yes. Store the service account key as a gcp_service_account resource and authorize its client ID for the admin.directory scopes in Admin console > Security > API controls > Domain-wide delegation. In a flow, run Get Access Token (Service Account) with an admin's email first, then pass its result as the Google Workspace resource of the following steps.
Which scopes does the connection need?
The default connection grants admin.directory.user, .group, .orgunit and .user.security, which covers every script. The .readonly variants are enough for the list and get scripts.
There is no Connect button on my instance
Self-hosted instances need a Google OAuth client configured once by an admin before the tile appears.