User Authentication in Apps Script Web Apps (Google SSO + Domain Lock)

Apps Script web apps can restrict access to users signed into Google and further limit to your Workspace domain using deployment Who has access settings plus Session.getActiveUser().getEmail().

Execute as User accessing web app ensures the script acts with that user's Sheet permissions, ideal for CRUD tools. Execute as Me uses the deployer's rights, simpler but broader.

Pair domain checks in doGet with Google Groups allowlists stored in a Config sheet for fine-grained authorization.

Example code

function assertDomainUser() {
  const email = Session.getActiveUser().getEmail();
  if (!email || !email.endsWith('@company.com')) {
    throw new Error('Unauthorized: domain users only');
  }
  return email;
}
function doGet() {
  assertDomainUser();
  return HtmlService.createHtmlOutput('<p>Welcome ' + Session.getActiveUser().getEmail() + '</p>');
}

FAQ