Identity and access management
Keka to Google Workspace integration: Google accounts from Keka, from joining date to exit
With an integration between Keka and Google Workspace, every new employee in Keka gets a Google account with job title, department, country and manager, and the account is suspended on the exit date in Keka. Keka does let employees sign in with their Google account, but we only found an account-creating integration for Entra ID; KoppelHet builds this flow through the Keka API.
What the integration does
Organisations that use Keka as their HR system and Google Workspace as their workplace often let employees sign in to Keka with Google. IT still creates that Google account by hand, and whoever leaves keeps Gmail until someone suspends the account.
- HR adds a new employee in Keka with joining date, job title and groups.
- KoppelHet creates the Google account suspended, in the unit of the country or location.
- On the joining date KoppelHet lifts the suspension; the new colleague then signs in to Keka with the same account.
- Changes in job title, groups or managers go through to Google.
- On the exit date KoppelHet suspends the account; on a cancelled exit KoppelHet switches it back on.
What to watch for with Keka and Google Workspace
- Keka lets employees with a Google Workspace account sign in without a password or one-time code, when an administrator enables that sign-in method. For that the account must already have been created by IT. KoppelHet creates the account before the joining date, so the Google sign-in to Keka works on the first day.
- Keka has its own provisioning integration with Entra ID, but for Google Workspace we only found the sign-in. KoppelHet reads Keka through the API, so Google can follow the same rules as a Microsoft environment of a sister company.
- Besides the direct manager Keka also has a dotted-line manager. Google has a relation type of its own for both. KoppelHet sets both, so the organisation structure in Google also shows matrix lines.
- Keka delivers department and location as groups with a group type, not as separate fields. KoppelHet chooses per group type what becomes department, Google group or organisational unit, so a new location in Keka does not automatically create a new unit in Google.
- An exit in Keka has an exit date and a status, and Keka sends an event when an exit is cancelled. KoppelHet suspends the Google account on the exit date and lifts the suspension on a cancellation, with mail and files still intact.
- Keka returns at most two hundred employees per page and allows fifty requests per minute. KoppelHet requests only the employees changed since the previous run every hour, and does the full comparison at night.
- Keka keeps a private address next to the work email. Google has a recovery email per account. If you want that, KoppelHet sets the private address from Keka as the recovery email, so a new colleague can recover a forgotten password themselves.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens during the notice period?
The account stays active until the exit date. If you want to revoke groups or shared drives during the notice period, that can be done based on the notice status in Keka.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Keka API (https://{company}.keka.com/api/v1) with a token from login.keka.com/connect/token (client_id, client_secret, api_key, scope kekaapi). GET /hris/employees with lastModified, employmentStatus (Working, Relieved), inNoticePeriod and pageSize (default 100, maximum 200); fields email, personalEmail, jobTitle, groups (with groupType), reportsTo, dottedLineManager, joiningDate, exitDate, exitStatus and countryCode. Event triggers as webhook, including exitCancelled. Fifty requests per minute.
- To Google through the Admin SDK Directory API (users with externalIds, name, primaryEmail, password, orgUnitPath, organizations, relations type manager and dotted_line_manager, recoveryEmail and suspended; groups and members), with a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Keka | Field in Google Workspace | Notes |
|---|---|---|
employeeNumber | externalIds (type organization) | |
firstName en lastName | name.givenName en name.familyName | |
Naamgevingsregel | primaryEmail | |
jobTitle | organizations.title | |
groups (groupType afdeling) | organizations.department en groepen | |
countryCode of locatiegroep | orgUnitPath | |
reportsTo | relations (type manager) | |
dottedLineManager | relations (type dotted_line_manager) | |
joiningDate en exitDate | suspended |
Related
Keka → Active Directory
Keka to Active Directory integration: domain accounts per office, with expiry on the exit date
Keka → ADP iHCM
Keka to ADP iHCM integration: salary structure, variable payouts and leavers of the Dutch pay group to ADP
Keka → AFAS Profit
Keka to AFAS integration: Dutch employees from Keka in payroll
Keka → Arbodienst (SIVI)
Keka to the occupational health service via SIVI: sickness leave requests as absence reports