Okta Workflows can connect to Google Cloud Platform (GCP) APIs whose scopes aren't covered by an out-of-the-box (OOTB) Okta Workflows connector by configuring a Custom API Connector with OAuth 2.0 authentication. This article uses the Cloud Resource Manager API as the example, but the same setup works with other cloud.google.com API endpoints, provided the endpoint is enabled and the correct scope is used. Administrators establish the connection and ensure access tokens refresh automatically by appending a specific query parameter to the authorization path during the Custom API Connector configuration.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows
• Google Cloud Platform (GCP) APIs
• Custom API Connector configurations for GCP scopes not covered by an OOTB Okta connector

What is the process for establishing an OAuth 2.0 connection to Google Cloud Platform in Okta Workflows?

Create a Google Cloud Platform (GCP) web application, enable the Cloud Resource Manager API, and configure the Okta Workflows API Connector to establish the OAuth 2.0 connection and refresh access tokens.

Configure the Google Cloud Platform web application.

Set up the GCP web application and enable the required API by following these steps:

1. Sign in to the Google Cloud Platform console.
2. Follow the instructions at Create a client ID and client secret to create a Webapp.
3. For the Redirect URI, use the following Redirect URIs for Okta Workflows Preview and Production organizations, respectively:
   • Preview: Enter the Okta Workflows Preview Redirect URI: https://oauth.workflows.oktapreview.com/oauth/httpfunctions/cb
   • Production: Enter the Okta Workflows Production Redirect URI: https://oauth.workflows.okta.com/oauth/httpfunctions/cb
4. Record the Client ID and Client Secret after completing the previous step.
5. Navigate to the Cloud Resource Manager API and enable it.

Configure the Okta Workflows API Connector.

Establish the OAuth 2.0 connection in Okta Workflows by following these steps:

1. Sign in to the Okta Workflows console.
2. Select Connections, choose New Connection, and select API Connector.
3. Enter a name and select Auth Type (Oauth).
4. Enter the following configuration details:
   • Authorize Path: Enter the Google OAuth 2.0 Authorize Path: https://accounts.google.com/o/oauth2/auth?access_type=offline&approval_prompt=force. Passing in access_type=offline as a query parameter allows for refreshing of the access token.
   • Access Token Path: Enter the Google OAuth 2.0 Token Path: https://www.googleapis.com/oauth2/v3/token
   • Scope: Enter the Google Cloud Platform Scope: https://www.googleapis.com/auth/cloud-platform
   • Client ID: Enter the Client ID recorded in step 4 of the previous section.
   • Client Secret: Enter the Client Secret recorded in step 4 of the previous section.
5. Select Create.
6. Follow the prompt to sign in to Google and grant access.

Verify the connection.

Verify the successful connection by executing a GET request to list all Google Cloud Projects attached to the account.

1. Execute a GET request to the Google Cloud Resource Manager API Endpoint.

Related References

• Authorize requests
• How to Authenticate with HTTP Cards Okta Workflows
• Google Ads API
• Google API - Refreshing an access token (offline access)