Google sign-in and Dome

1. 01

   Register Google as a verification provider

   The issuer is the same for every Google account. Pin the audience to your app's OAuth client ID.

   $ dome verification-providers create \
     --name google \
     --method oidc \
     --oidc-url https://accounts.google.com \
     --oidc-expected-audience <client-id>.apps.googleusercontent.com

2. 02

   Pass the user's ID token with each call

   Send the ID token from sign-in, with the email scope. Google access tokens aren't JWTs, so Dome can't verify them.

   from openai import OpenAI
    
   client = OpenAI(
       base_url=f"{GATEWAY_URL}/v1",
       api_key=DOME_AGENT_KEY,
       default_headers={"X-Dome-Act-As": google_id_token},
   )

3. 03

   Scope by Workspace domain

   Google sets hd only for Workspace and Cloud organization accounts. It arrives under principal.act_as.claims.

   principal has act_as &&
   principal.act_as has claims &&
   principal.act_as.claims has hd &&
   principal.act_as.claims.hd == "example.com"

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Google itself, see Google's documentation.

forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "github" }
unless {
  principal has act_as &&
  principal.act_as has email &&
  principal.act_as.email like "*@example.com"
};