How to create a Google Cloud project and OAuth consent screen for your application before generating OAuth credentials?

Google Cloud Project Creation

Before you can create OAuth credentials, you need a Google Cloud project. This project serves as a container for all your APIs and authentication configurations.

Note: If you already have an account with ‘Google Cloud console” you can skip Step 1.

STEP 1: Access Google Cloud Console

The Google Cloud Console is where you'll manage all your cloud resources and OAuth configurations.
Instructions:

1. Navigate to https://console.cloud.google.com/ 
2. Sign in with your Google Account (use an account with admin access)
3. If you see a welcome screen, read through it and click "Agree and continue"
4. Accept the terms of service if prompted

STEP 2: Create a New Project

A Google Cloud project is a container that holds all your APIs, credentials, and settings.
Instructions:

1. Click on the Project Selector dropdown on the top left of the page.
   
2. In the popup window that appears, click the blue "NEW PROJECT" button. 
   
3. A form will appear asking for project details:
   • Project Name: Enter a meaningful name like "My Backup Application" or "OAuth Integration Project"
   • Organization: This will likely be auto-filled or show "No organization"
   • Parent resource: Select your organization.
   
4. Click on "CREATE" button.
   
5. You'll see a notification at the bottom right indicating "Project creation in progress." Once complete, you'll be automatically switched to your new project.

STEP 3: Enable Required APIs

1. Go to the home page of the project created.
   
2. Search for ‘Admin SDK API’ in the search bar.
   
3. Click on ‘Enable’
   
4. Wait for the API to be enabled (you'll see a loading indicator)
   Note: When you enable an API, Google Cloud grants your project access to that API. This doesn't immediately consume resources; it just makes the API available for your project to use.
   
5. Repeat the same process and enable all the below mentioned APIs
   

   #	API to enable	Service name	Why it is required
   1	Admin SDK API	admin.googleapis.com	Required for users, groups, organizational units, domains, roles, calendar resources, ChromeOS devices, mobile devices, user schemas, audit reports, and Chrome printers.
   2	Chrome Policy API	chromepolicy.googleapis.com	Required for ChromeOS and Chrome browser policy backup.
   3	Chrome Management API	chromemanagement.googleapis.com	Required for Chrome app details and Chrome management information.
   4	Drive Labels API	drivelabels.googleapis.com	Required for Google Drive admin labels metadata.
   5	Groups Settings API	groupssettings.googleapis.com	Required for Google Groups settings.
   6	Enterprise License Manager API	licensing.googleapis.com	Required for Google Workspace license information.
   7	Access Context Manager API	``	Required for Context Aware Access information.
   8	Cloud Resource Manager API	``	Required for Cloud Resource Manager information.
   9	Identity and Access Management (IAM) API	``	Required for Identity and Access Management (IAM) information.
   10	Cloud Identity-Aware Proxy API	``	Required for Cloud Identity-Aware Proxy information.

6. Enable, Cloud Identity API. Sometimes, it is not found in the API marketplace, hence go to the link mentioned below and select you project and click on 'Enable'.
   Link - https://console.cloud.google.com/apis/library/cloudidentity.googleapis.com?project=YOUR_PROJECT_ID

PHASE 2: OAuth 2.0 Consent Screen Configuration

The OAuth consent screen is what users see when they're asked to authorize your application. It should clearly explain what your application does and what permissions it needs.

STEP 4: Create OAuth 2.0 Consent Screen

Instructions:

1. Navigate to 'Google Cloud' home page with your project selected.
   
2. In the left sidebar under "APIs & Services," click "OAuth consent screen"
   
3. Click on 'Get Started'.
   

STEP 5: Configure Consent Screen Details

Instructions:

1. Configure app information
   1. Application Name: Enter your application's name (e.g., "MyCompany Backup Service"). This will appear on the consent screen, so make it something users will recognize.
   2. User Support Email: Enter an email address where users can contact you if they have questions about your application's privacy or security.
2. Click on 'Next'
   
3. Configure audience
   1. External: Choose this option (recommended for most applications). This allows you to create an application that can be used by anyone with a Google account.
   2. Internal: Choose this only if your organization specifically requires it. This limits access to users within your Google Workspace domain.
4. Click on 'Next'
   
5. Developer Contact Information: Enter your contact email (e.g., admin@mycompany.com). This is where Google will contact you if there are issues with your application.
6. Click on 'Next'
   
7. Agree to Google terms and 'Continue'
   
8. Click on 'Create'
   
9. Click on 'Branding' in the left navigation and scroll-down to find 'Authorized domains'.
   
10. Authorized Domains: Add the domain(s) where your application is hosted:
    • Click "Add Domain"
    • Enter your domain name (e.g., backup.mycompany.com)
    • You may need to verify domain ownership. If prompted, follow Google's verification process.
    • Add multiple domains if your application is hosted in multiple locations
11. Click on 'Save'.
    

STEP 6: Define OAuth Scopes

Scopes define what permissions your application is requesting.
Instructions:

1. On the left navigation, click on 'Data access'.
2. Click "ADD OR REMOVE SCOPES"
   
3. A scope selection dialog will appear with a search bar and list of available scopes
4. You need to add all the 23 required scopes for this integration (see the detailed scope section below for descriptions)
5. For each scope, either:
   • Search for it by name in the search box
   • Scroll to find it in the list
   • Click the checkbox next to the scope to select it
   • Clear the search bar and repeat the steps for the next scope
     
     
   Or Copy paste the below scopes in 'Manually add scopes' text box in the side tray, click on 'Add to table'.
   
   https://www.googleapis.com/auth/admin.directory.user
   
   https://www.googleapis.com/auth/admin.directory.user.security
   
   https://www.googleapis.com/auth/admin.directory.group
   
   https://www.googleapis.com/auth/admin.directory.orgunit
   
   https://www.googleapis.com/auth/admin.directory.domain
   
   https://www.googleapis.com/auth/admin.directory.rolemanagement
   
   https://www.googleapis.com/auth/admin.directory.resource.calendar
   
   https://www.googleapis.com/auth/admin.directory.device.chromeos
   
   https://www.googleapis.com/auth/admin.directory.device.mobile
   
   https://www.googleapis.com/auth/admin.directory.device.mobile.action
   
   https://www.googleapis.com/auth/admin.directory.userschema
   
   https://www.googleapis.com/auth/admin.reports.audit.readonly
   
   https://www.googleapis.com/auth/chrome.management.policy
   
   https://www.googleapis.com/auth/admin.chrome.printers
   
   https://www.googleapis.com/auth/cloud-identity.userinvitations
   
   https://www.googleapis.com/auth/cloud-identity.groups
   
   https://www.googleapis.com/auth/cloud-identity.inboundsso
   
   https://www.googleapis.com/auth/cloud-identity.policies
   
   https://www.googleapis.com/auth/drive.admin.labels
   
   https://www.googleapis.com/auth/cloud-platform
   
   https://www.googleapis.com/auth/apps.groups.settings
   
   https://www.googleapis.com/auth/apps.licensing
   
   https://www.googleapis.com/auth/chrome.management.appdetails.readonly
   
   
   
   
6. Once you've selected all 23 scopes, click "UPDATE"
7. Click "Save".
   

Scope Summary Table

Click here to know, how to generate the OAuth client credentials to connect your Google Admin Console to SysCloud backup application.