Google Workspace sign-in without codes or prompts
Add NearAuth.ai to Google Workspace for one group. People in that group are signed in to Google only while their own phone is next to their own computer, with no code to type and no prompt to approve. Everyone else signs in to Google as usual.
How it works
Google hands over sign-in
You assign NearAuth.ai's SAML SSO profile to one Google group. Sign-ins from that group go to NearAuth.ai.NearAuth.ai checks presence
The person's phone and computer confirm they're side by side with an encrypted Bluetooth exchange that our server verifies.Back to Google
With the phone nearby they land in their account. With the phone in another room, they don't get straight in.Setup in seven steps
About 30 minutes. Your NearAuth.ai admin console shows the exact values to paste, filled in for your company. The sign-up guide has every click.
- Let people sign in to NearAuth.ai with Google. Create an internal OAuth client in the Google Cloud console and enter its client ID and secret in NearAuth.ai.
- Connect your Workspace. Give NearAuth.ai domain-wide delegation for the scopes listed in your guide. It uses them to manage the NearAuth group, sign people out of Google when their devices are reset, and check that nobody signing in has been suspended.
- Create an empty Google group, for example nearauth-users@yourcompany.com.
- Add the SAML profile. In the Google Admin console, under Security > Authentication > SSO with third-party IdP, add a profile with NearAuth.ai's entity ID, sign-in URL, sign-out URL and certificate. Don't assign it yet.
- Register Google in NearAuth.ai. Copy the profile's Entity ID and ACS URL into NearAuth.ai's Service Providers page.
- Choose the group in NearAuth.ai and run the access check.
- Assign the profile to the group and test with your own account: once with your phone nearby, once with it in another room. Then add everyone whose phone is set up.
What your team notices
- No codes and no push approvals at their desk.
- When they walk away with their phone, NearAuth.ai stops vouching for that computer. When they come back, access returns.
- Google sign-in on their own computer works as it always did, minus the second step.
What admins get
- A record of every check, with the person, computer, IP address and time.
- Group-based rollout: invite a whole Google group, and each person is added once their phone is ready.
- People are signed out of Google when their devices are reset, and suspended accounts are refused.
What it doesn't do
- Super admin sign-ins aren't covered, because Google doesn't allow it.
- Once someone is in the group, they can't sign in to Google without NearAuth.ai on their phone. Add only people who are set up.
- Every person needs the NearAuth.ai app on their phone and on their Mac or Windows computer, with Bluetooth on.
Using Microsoft instead? See NearAuth.ai for Microsoft Entra ID. Comparing options? See how NearAuth.ai compares with MFA and NearAuth.ai as a Duo alternative.
Google Workspace is a trademark of Google LLC. NearAuth.ai is not affiliated with Google.
Frequently asked questions
How does NearAuth.ai connect to Google Workspace?
As a third-party identity provider. You add NearAuth.ai as a SAML SSO profile in the Google Admin console and assign that profile to one Google group. Google then hands sign-in for the people in that group to NearAuth.ai, which checks that each person's own phone is next to their own computer.
Does it replace Google 2-Step Verification?
For the people in the NearAuth group, Google hands the sign-in to NearAuth.ai instead of running its own. Everyone outside the group keeps signing in to Google exactly as before, including with 2-Step Verification.
Can we try it with a few people first?
Yes. Only people in the Google group you choose are sent to NearAuth.ai. Start with yourself, then add people as their phones are set up. To undo it for one person, take them out of the group.
Are Google super admins covered?
No. Google never sends super admins to a third-party identity provider, so their sign-ins aren't covered. Keep super admin accounts few and protect them with a hardware security key.
What do we need?
A Google Workspace super administrator, access to the Google Cloud console for your organization, a NearAuth.ai administrator account with an email in your Workspace domain, and about 30 minutes.
What happens if NearAuth.ai is unavailable?
Keep two emergency super admin accounts that never sign in through NearAuth.ai. The admin console has an 'If NearAuth is unavailable' page that shows how to switch everyone back to Google's own sign-in in minutes; print it or save it somewhere you can reach without NearAuth.ai.
Does it cover apps that use Sign in with Google?
Apps that rely on the person's Google session are covered when that session is started or renewed. Setting Google's web session length to one hour sends people back through NearAuth.ai every hour; with their phone nearby that's a quick redirect, not a prompt.
How much does it cost?
The Essential plan is free for up to 12 users, with no credit card. Advanced is $6 and Enterprise $9 per user per month.
Free for up to 12 people
- The Essential plan is free for teams of up to 12, with Google Workspace or Microsoft 365. No credit card.
- Most teams have their first five people running in about 15 minutes.
- A bigger team? Advanced is $6 and Enterprise $9 per user per month. Book a 15-minute demo and we'll help you roll it out.
Christopher McLain, founder • chris@nearauth.ai • 607-238-3533