Federate Google Workspace to Wink

Once done, users in your pilot group sign into Gmail (and every Google service) with their Wink biometric instead of a Google password. Takes about 5 minutes.

Before you start

Google Workspace admin access on your own custom domain
1–2 pilot users whose Google emails will be linked to Wink identities
A super-admin account that's not in the pilot group — your break-glass if anything breaks (Google auto-exempts super-admins from SSO)

Create a pilot group

Federate 1–2 test users first, not your whole tenant. Lets you prove the flow before rolling out broadly.

admin.google.com → Directory → Groups → Create group
Name: SSO Pilot, email: sso-pilot@yourcompany.com
Add 1–2 test users (not your super-admin)

Add the SAML SSO profile

Tells Google where to send users for authentication and how to verify the response. Wink only supports SAML — pick the SAML option, not OIDC.

admin.google.com → Security → Authentication → SSO with third-party IdP
Click Add SAML profile — not Add OIDC profile. Google now offers both; Wink's IdP speaks SAML 2.0.
Fill in exactly:

IdP entity ID

https://idp.winkkey.net/api/metadata

Sign-in page URL

https://idp.winkkey.net/sso

Sign-out page URL

https://mail.google.com

Change password URL

https://idp.winkkey.net/

Verification certificate

Click below to download the IdP signing certificate as a .pem file, then upload it via Google admin's Upload certificate button. (Google requires a file upload here — pasting the cert text won't work.)

Download idp.winkkey.net.pem ↓

Need the raw metadata XML for advanced setups? https://idp.winkkey.net/api/metadata

Assign the profile to your pilot group

Other users keep using Google's normal sign-in until you broaden the rollout.

admin.google.com → Security → Authentication → SSO with third-party IdP → Manage SSO profile assignments
Click your new profile → assign to Group = sso-pilot@yourcompany.com
Save

Disable Post-SSO verification

Without this, Google will still challenge your users with device prompts (YouTube, SMS, etc.) even after successful Wink biometric. This is the most-skipped step.

admin.google.com → Security → Authentication → Login challenges
Click Post-SSO verification to expand the panel
Under Settings for users signing in using other SSO profiles, select Don't ask users for additional verifications from Google
(If your tenant also has a legacy single-IdP setup, do the same under Settings for users signing in using the legacy SSO profile)

Heads-up: this setting is global for all users on a custom SSO — Google doesn't let you scope it to a single OU, group, or SSO profile. Once you flip it, every user signing in via any third-party IdP skips Google's post-SSO challenge.

Note: this is separate from 2-Step Verification. Even if 2SV is off, the post-SSO risk challenge fires unless you set this.

Activate your tenant and add your users

Self-serve. Bring the values Google generated for you and the initial user-to-Wink mapping to your tenant portal.

Go to winkkey.net/sso/activate
Paste your tenant key (the wkey_… you saved at signup)
Paste your Google SAML profile ID and ACS URL from the profile's Service Provider details panel (admin.google.com → Security → Authentication → SSO with third-party IdP → click your profile)
Add a row per pilot user mapping their Google email to a Wink identity:

alice@yourcompany.com  →  alice@wink.cloud
bob@yourcompany.com    →  bob@wink.cloud

(winktag preferred over email if you have it; either works. For users whose handle is identical on both sides, you can leave them out and our verified-domain fallback will let them through.)

To add or remove users later, return to winkkey.net/sso/manage with the same tenant key. Changes take effect immediately.

Enroll your pilot users with WinkKey

Each pilot user needs a Wink identity before SSO can authenticate them. Two ways to get one.

Option A — proactive (recommended)

Share winkkey.net/enroll with your pilot users. Each one walks through WinkKey's enrollment flow once (face capture + passkey on their device) and ends up with a Wink identity. Use the email or winktag they end up with as the right-hand side of the mapping in /sso/manage.

Option B — inline on first sign-in

If a user hasn't enrolled when they try Gmail SSO, the first redirect to WinkKey will offer them an enrollment step right there. They complete it, then continue straight back to Gmail. Slower the first time but zero pre-onboarding for you.

Test

From a fresh incognito window so you don't hit cached sessions.

Heads-up: SSO won't work until a Wink admin has approved your tenant key AND you've completed activation. Approval typically lands within a business day; you'll get an email when it's done.

Open https://mail.google.com
Type a pilot user's email
Should redirect to Wink for biometric → land in Gmail, no password

Things to know

Existing 2-Step Verification stays enrolled but dormant for pilot users during SSO sign-in. It's only used for break-glass scenarios outside SSO.
Super-admins always go through Google's own login regardless of this profile — your safety valve if SSO breaks.
One Wink identity ↔ one Google account in pilot mode. If you need multiple Google accounts per Wink user, ask ops.
Sign-out lands users on Gmail's sign-in page (configured in step 2).

If something goes wrong

Symptom	Likely cause
Google says "domain not configured"	Wink's SP config doesn't know about your domain's profile yet — send Wink ops the SAML profile ID Google generated (visible in admin → SSO profile → SP details).
User still gets a 2-Step prompt	Step 4 wasn't saved on the right OU.
User can't complete biometric	User's Wink identity isn't enrolled, or mapping in step 5 hasn't been added.
User signed in as the wrong person	Mapping points to a different Wink identity than expected. Fix it at /sso/manage.