Connect your identity provider to Nettle

Your team signs in to Nettle with the Google or Microsoft accounts they already use. To make that happen, you create a small app registration in your own admin console and send us the Client ID and Client Secret it gives you. This guide walks you through it, screen by screen.

Choose your identity provider:

Before you begin #

Have these ready:

• Admin access to your identity provider. For Google, an account that can create projects and OAuth clients in Google Cloud (for example Project Owner or Editor, or OAuth Config Editor on an existing project). For Microsoft, at least the Application Developer role to register the app, and Cloud Application Administrator or higher to grant admin consent.
• Your redirect URI (above). It must match exactly: https, the auth- prefix, and no trailing slash.
• Somewhere safe to keep the secret, such as your password manager. Both consoles show the secret only once.

These are the values you'll enter in your console:

Google Workspace: create an OAuth client #

You'll set up the Google Auth Platform in a Google Cloud project, then create an OAuth client of type Web application. Google Cloud is free for this; no billing account is needed.

Video walkthrough

2 min 23 s · Webigenci on YouTube · shows the current Google Auth Platform screens. When the video asks for a redirect URI, use yours: https://auth-your-company.nettle.llc/oauth2/callback.

Step-by-step

1. Create a Google Cloud project

   Go to console.cloud.google.com/projectcreate, signed in with your Google Workspace admin account. You can also reuse an existing project, but a dedicated one keeps things tidy.

   • Project name: Nettle SSO (or anything you like).
   • Organization: choose your company's organization. This is what lets you restrict sign-in to your own staff in step 3.

   Click Create, then make sure the new project is selected in the project picker at the top of the page.

   

2. Open Google Auth Platform and click Get started

   Open Google Auth Platform (search for "Google Auth Platform" in the console search bar, or go to APIs & Services → OAuth consent screen). If the project hasn't been configured yet, you'll see Google Auth Platform not configured yet. Click Get started.

   

   Already see Overview, Branding, Audience and Clients with no "Get started" button? The project is already configured. Skip to step 5.

3. Fill in the project configuration

   The wizard has four short sections:

   1. App Information: App name Nettle, and a User support email (your IT helpdesk group or your own address). Click Next.
   2. Audience: choose who can sign in:
      • Internal (recommended): only accounts in your Google Workspace organization. Google itself blocks everyone else.
      • External: any Google account. Pick this only if people outside your Workspace organization need access; Nettle then admits only the email domains you send us.
      Internal is available only if the project belongs to a Google Workspace or Cloud Identity organization (step 1).
   3. Contact Information: an email address Google can contact about the project.
   4. Finish: agree to the Google API Services User Data Policy, then click Create.

   

   

4. Publish the app (External audience only) Optional

   Skip this step if you chose Internal.

   New External apps start in Testing. Open Audience and click Publish app, then Confirm. Because Nettle requests only basic sign-in scopes (name, email, profile), publishing needs no Google verification or review. You don't need to add test users.

   

5. Create the OAuth client

   Go to Clients in the left menu and click + Create client. On a brand-new project, the Overview page has a Create OAuth client button that leads to the same place.

   

   Fill in the form:

   • Application type: Web application
   • Name: Nettle (internal label; users don't see it)
   • Authorized JavaScript origins: leave empty
   • Authorized redirect URIs: click + Add URI and paste:
   Redirect URI https://auth-your-company.nettle.llc/oauth2/callback Copy

   Click Create.

   

   Google notes that changes "may take 5 minutes to a few hours" to take effect. If a first test sign-in shows redirect_uri_mismatch, wait a few minutes and try again.

6. Copy the Client ID and Client Secret

   The OAuth client created dialog shows both values. Copy each with its copy icon, or click Download JSON, and store them in your password manager before clicking OK.

   

   The secret is shown only onceSince 2025, Google never shows a client secret again after you close this dialog; afterwards you'll see only its last four characters. If you lose it, open the client and use Add secret to make a new one.

7. Send the credentials to Nettle

   You now have a Client ID and a Client Secret. Follow Send your credentials to Nettle. Never put the secret in plain email.

Microsoft Entra ID: register an app #

You'll create an app registration in the Microsoft Entra admin center, add a client secret, and confirm the sign-in permissions. Entra ID is the new name for Azure Active Directory, and the steps are the same in the Azure portal.

Video walkthrough

1 min 31 s · Outright Systems on YouTube · uses the current (2026) app-registration screens in the Azure portal; the Entra admin center has the same pages. Use your redirect URI, not the one in the video. Mixing up the secret Value and Secret ID? Watch this 4-minute explainer.

Step-by-step

1. Open App registrations

   Sign in to the Microsoft Entra admin center with at least the Application Developer role. If you have more than one tenant, use the Settings icon in the top bar to switch to the one your staff sign in with.

   Go to Entra ID → App registrations and click + New registration.

2. Register the application

   • Name: Nettle. Users may see this name when they sign in.
   • Supported account types: Single tenant only. Older versions of the screen label it Accounts in this organizational directory only.
   • Redirect URI: choose platform Web and paste:
   Redirect URI https://auth-your-company.nettle.llc/oauth2/callback Copy

   Click Register.

   

   No redirect URI field on your form? Register first, then open Authentication → Add a platform (or Add Redirect URI) → Web, and paste it there. Leave the front-channel logout URL and the implicit-grant checkboxes empty.

3. Copy the Client ID and Tenant ID

   You land on the app's Overview page. Copy two values from Essentials:

   • Application (client) ID: this is your Client ID
   • Directory (tenant) ID: this is your Tenant ID

   Ignore Object ID; it's a different value.

   

4. Create a client secret

   Go to Certificates & secrets → Client secrets and click + New client secret.

   • Description: Nettle SSO
   • Expires: we suggest 365 days. The maximum is 24 months; when it expires, sign-in stops (see rotating secrets). Note the date in your calendar.

   Click Add.

   

   The new secret appears in the table. Copy the Value column now using its copy icon, and store it in your password manager.

   

   Value, not Secret ID, and only onceThe table has two similar columns: Value is the secret, and Secret ID is just its identifier. The Value is hidden for good once you leave the page. Sending the Secret ID is the #1 cause of error AADSTS7000215.

5. Add sign-in permissions and grant admin consent

   Go to API permissions. Microsoft Graph → User.Read is already there. Add the standard sign-in permissions:

   1. Click + Add a permission → Microsoft Graph → Delegated permissions.
   2. Under OpenId permissions, tick email, offline_access, openid and profile.
   3. Click Add permissions.

   

   Then click Grant admin consent for <your organization> and confirm with Yes. Every row's status should turn to a green Granted. This needs the Cloud Application Administrator role or higher, and it means your users won't see a consent prompt.

   

6. Add the email claim

   Nettle identifies people by email address. To make sure Microsoft always includes it:

   1. Go to Token configuration → + Add optional claim.
   2. Token type ID, tick email, click Add.
   3. If asked, tick Turn on the Microsoft Graph email permission and confirm.

   

   The claim is filled from each user's Email (mail) attribute. Accounts without a mailbox or email address can't sign in to Nettle, so check that service or shared accounts have one set.

7. Restrict who can sign in Optional

   By default, everyone in your tenant can sign in to the app (and Nettle then checks their email domain). To allow only specific people or groups:

   1. Go to Entra ID → Enterprise applications → All applications and open Nettle.
   2. Under Properties, set Assignment required? to Yes and click Save.
   3. Under Users and groups, click + Add user/group and assign the people or groups who should have access.

   

   

   With assignment required, users can't consent for themselves, so do step 5's Grant admin consent first. Assigning groups needs Entra ID P1 or P2; nested groups aren't supported.

8. Send the credentials to Nettle

   You now have a Client ID, a Tenant ID and a Client Secret (the Value). Follow Send your credentials to Nettle. Never put the secret in plain email.

Send your credentials to Nettle #

When you're done, you'll have:

1. Email the Client ID, the Tenant ID (Microsoft only) and your allowed email domains to info@nettle.llc from your company address, with your workspace name in the subject.
2. Send the Client Secret separately as a one-time link: paste it into share.doppler.com (free, no account needed, end-to-end encrypted), set it to expire after 1 view, and email us the link. Your password manager's secure share (for example 1Password or Bitwarden Send) works too.
3. We'll add the credentials to your workspace and agree a time with you to test sign-in before switching your team over. Until then, your current sign-in keeps working.

Rotating and expiring secrets #

Microsoft secrets expire

Every Entra ID client secret has an expiry date, at most 24 months from creation. When it passes, sign-in to Nettle stops working with error AADSTS7000222. To avoid downtime:

1. About a month before expiry, add a new client secret to the same app registration (Certificates & secrets → New client secret). The old one keeps working alongside it.
2. Send us the new secret the same secure way as before.
3. Once we confirm the switch, delete the old secret.

Google secrets don't expire

Google client secrets stay valid until you disable or delete them. To rotate one, open the client in Google Auth Platform → Clients, click Add secret, send us the new secret, and once we confirm, Disable and then delete the old one. A client can hold two secrets at once, so there's no downtime.

Troubleshooting #

Most sign-in problems come from a small mismatch between your console and what Nettle sends. Find the error your users see below. Error codes appear on the Google or Microsoft error page, often under "Error details" or "Troubleshooting details".

Google

Microsoft

Any provider

FAQ #