> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/human-access/how-to-guides/auto-provisioning/how-it-works/sign-in-with-google.md).

# Sign in with Google

Some apps only let users sign in through Google. For those apps, Agent Cake signs in with a Google account instead of an app username and password.

There are two ways this works, depending on the app:

* **A connected Google account.** You connect the account once in Settings, then pick it when you configure an app. Every app that supports this can reuse the same account.
* **Google credentials entered in the app's configuration.** Some apps ask for the Google account details directly on their own configuration screen. See the app's [integration guide](/docs/human-access/connections-and-integrations/integration-guides.md).

Both approaches sign in the same way. Cakewalk drives Google's own sign-in page with the account's password and verification code. It is not an OAuth consent screen, so the requirements below apply either way.

#### Requirements

The Google account must:

* Be able to sign in with a password. Accounts that only accept passkeys or security keys will not work.
* Use an **authenticator app** for 2-Step Verification, if 2-Step Verification is enabled. Agent Cake enters a time-based code and cannot approve a prompt on someone's phone.
* Have the permissions needed to create users and assign roles in the target app.

The guidance in [Set up Service Accounts](/docs/human-access/how-to-guides/auto-provisioning/how-it-works/set-up-service-accounts.md) still applies. Use a dedicated account rather than a person's own login.

#### Connect a Google account

1. Go to `Settings` > `Account` > `Auto provisioning`.
2. On the **Sign in with Google** card, click `Connect`.
3. Enter the account email and password, then click `Continue`.
4. Enter the **MFA Secret** for the account. This is the setup code from the account's authenticator app.
5. Cakewalk shows a one-time password and a countdown to the next code. Enter it in Google to confirm the secret is correct. This step is optional, but it catches a mistyped secret before it breaks a provisioning run.
6. Click `Verify & connect`.

You can connect more than one account. Use `New` on the card to add another.

#### Use a connected account for an app

1. Go to `App governance` and open the app.
2. Click `Provisioning`, then `Configure` next to Cakewalk.
3. On the **Sign-in method** step, choose **Sign in with Google**.
4. Pick the account you want to use, then click `Continue`.
5. Set the access options, then click `Save & Enable`.

The Sign-in method step comes first, and only for apps that offer more than one way to sign in. An app that supports a connected Google account and nothing else opens on account selection instead. An app with no Google support never shows the step and asks for a username and password as before.

If no account fits, `Add another account` connects a new one without leaving the configuration. It asks for the same email, password and MFA secret as the Settings flow.

Some apps need a connected inbox so Agent Cake can read a verification code out of it. On those, `Username and password` is greyed out on the Sign-in method step until an Admin connects an inbox. `Sign in with Google` stays available, because Google configurations do not use an inbox. See [Email Verification](/docs/human-access/how-to-guides/auto-provisioning/how-it-works/email-verification.md).

#### Apps with their own two-factor authentication

An app can enforce its own two-factor authentication on top of the Google sign-in. That is a second, separate code, and it belongs to the app rather than to Google.

On the **Google account** step, turn on **Multi-Factor Authentication** and enter the app's MFA secret. You can paste the secret or upload the QR code image the app shows during setup.

Two secrets can be in play for one app:

| Secret                    | Where you enter it                                 | What it protects            |
| ------------------------- | -------------------------------------------------- | --------------------------- |
| Google account MFA secret | `Settings` > `Account` > `Auto provisioning`, once | The Google sign-in          |
| App MFA secret            | The app's configuration, per app                   | The app's own second factor |

{% hint style="info" %}
**Note:** Some apps require their own MFA secret. For those, the configuration will not save until you provide it. Check the [integration guide](/docs/human-access/connections-and-integrations/integration-guides.md) for the app.
{% endhint %}

#### Manage connected accounts

Each account on the **Sign in with Google** card shows its status and the apps using it. Open the menu on an account to change its password or delete it.

* **Change password**: use this whenever the Google password changes. The flow asks for the new password and the MFA secret again, then verifies both before saving.
* **Delete**: removes the account from Cakewalk. Check the apps listed on the account first. Any app using it will stop provisioning.

#### Statuses

| Status     | What it means                                                        |
| ---------- | -------------------------------------------------------------------- |
| **Active** | Cakewalk can sign in with the account                                |
| **Error**  | The credentials no longer work, usually because the password changed |

An account in **Error** cannot be selected for a new app configuration, and apps already using it stop provisioning until it is fixed. Use `Change password` on the account to restore it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.cakewalk.security/docs/human-access/how-to-guides/auto-provisioning/how-it-works/sign-in-with-google.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.