Google Groups & Password Resets

Unthread's Google Groups integration lets you add and remove group members from an automation. To set it up, head to Settings → Apps & Integrations → Google Groups and hit Configure Service Account. You'll create a service account in your Google environment and grant it permission to manage your Workspace groups.

Prerequisites

Before starting, make sure you:

• Have super administrator access to your Google Workspace organization. Only a super admin can grant the Group Administrator role used in Step 5.
• Have permission to create projects, service accounts, and keys in Google Cloud
• Can access both the Google Cloud Console and the Google Admin Console
• Have Google Groups for Business enabled for in Google Admin Console, with group creation allowed in your Groups for Business sharing settings
  • This is on by default, but will fail if disabled. This is configured in the Admin Console under Apps → Google Workspace → Groups for Business.

Step 1: Create or select a Google Cloud project

1. Go to the Google Cloud Console.
2. In the top navigation bar, click the Project Selector.
3. Either select an existing project, or click New Project and create one (e.g. Unthread Integration).

Step 2: Enable the required API

Unthread manages group membership through the Cloud Identity Groups API.

1. Open the Cloud Identity API page in the Google Cloud Console, confirming your project is selected in the top navigation bar.
2. Click Enable. If the page already reads "API enabled", you're done.

This API doesn't reliably appear when searching APIs & Services → Library, so use the link above rather than browsing for it. You'll need the serviceusage.services.enable permission, which comes with the Owner or Service Usage Admin role.

If you also plan to use the Reset Google Password automation action, additionally enable the Admin SDK API and complete Step 7.

Step 3: Create a service account

1. Go to IAM & Admin → Service Accounts.
2. Click Create Service Account.
3. Enter the following:

4. Click Create and Continue.
5. No Google Cloud IAM roles are needed here — click Done. Group access is granted separately in Step 5, on the Google Workspace side.

Step 4: Generate a private key

1. In the Service Accounts list, click your new service account.
2. Open the Keys tab.
3. Click Add Key → Create New Key.
4. Select JSON and click Create.

A JSON key file downloads to your computer. Open it and note two values you'll need shortly:

• client_email — for example unthread-groups-access@your-project.iam.gserviceaccount.com. This is the Service Account Email.
• client_id — a long numeric value. This is the service account's unique ID, used in Step 5 and Step 7.

⚠️ Important: Store this file securely. It contains credentials that allow API access to your Google environment.

Step 5: Grant the service account the Group Administrator role

This step is required. Without it, every add or remove will fail with a permission error.

Assign the Google Workspace Group Administrator admin role to the service account. This gives it access to the groups in your domain and no other resource.

1. In the Google Admin Console, go to Account → Admin roles.
2. Open Group Admin (Groups Administrator).
3. Click Assign service accounts.
4. Enter the service account's email address and assign the role.

If the Admin Console doesn't offer a service account assignment option in your edition, assign the role through the Admin SDK Role Assignments API instead, with assignedTo set to the service account's unique ID.

Role assignments can take a few minutes to propagate. If the first automation run fails with a permission error, wait briefly and re-run it.

Note that domain-wide delegation is not required for group management. Unthread's group actions authenticate as the service account itself, which means your Groups audit log attributes each membership change to the service account rather than to an impersonated administrator.

Step 6: Add credentials to Unthread

In Unthread, navigate to Settings → Apps & Integrations → Google Groups and enter:

All three fields are required in order to save. The Delegated Workspace Admin Email is used only by the Reset Google Password automation action (Step 7) — group membership actions ignore it — but a valid administrator address must be supplied to save the configuration.

Click save. The Google Group actions will now appear in the automation builder.

Step 7: Enable password resets (optional)

The Reset Google Password automation action uses the same service account, but it requires domain-wide delegation because it calls the Admin SDK on behalf of an administrator. Skip this step if you only need group membership.

1. Enable Admin SDK API in the Google Cloud Console (APIs & Services → Library).
2. In the Google Cloud Console, open the service account, click Edit, and enable Google Workspace Domain-wide Delegation. Note the Client ID.
3. In the Google Admin Console, go to Security → Access and data control → API controls → Domain-wide delegation and click Add new.
4. Enter:

5. Click Authorize.

The administrator you entered as Delegated Workspace Admin Email must have permission to reset user passwords. When this action runs, Unthread generates a temporary password, requires a change at next sign-in, and delivers the password to the user over Slack DM, falling back to email if Slack delivery fails.

Using the actions in an automation

Add the Add User to Google Group or Remove User from Google Group action to any automation. Each takes two inputs:

• Google Group — either the group's email address (e.g. engineering@example.com) or its numeric group ID. Both work; email addresses are resolved automatically. You can also pull the value from a field on the conversation or ticket instead of hardcoding it.
• User — the Unthread user to add or remove.

Unthread matches the user to Google by the email address on their Unthread user record, so that address must match the user's Workspace primary address or a resolvable alias. Users with no email on their record will cause the action to fail.

These actions are safe to re-run. Adding a user who is already a member, or removing a user who isn't one, is recorded in the automation run log and treated as a success rather than an error.

Troubleshooting

Check the automation run log for the specific message:

Security best practices

• Treat the JSON private key like a password
• Do not commit it to source control
• Assign only the Group Administrator role — it scopes the service account to groups and nothing else. Avoid Super Admin.
• Only complete Step 7 if you need password resets — domain-wide delegation grants broader access than group management requires
• Rotate the key periodically, and restrict service account access to administrators only