Skip to main content
Domain Restrictions make sure every new OAuth connection to a given app uses an email from a domain your organization owns. This prevents users from connecting personal accounts to business-critical apps by mistake.
Domain Restrictions tab showing a Google Sheets domain restriction allowing gumloop.com with an enabled toggle

​
What it does

When someone in your organization connects a new credential to a protected app, Gumloop inspects the email address of the account they’re authorizing. If that email’s domain isn’t on the allowlist you’ve configured, the OAuth flow fails and their connection is not saved. Domain Restrictions only affect new connections. Existing credentials that were already connected before the restriction was added continue to work — revoke them manually if you want to remove them.
Not every app supports Domain Restrictions. The Available Apps section of the tab lists only the apps where Gumloop can reliably read the connecting user’s email from the provider (Google Workspace, Slack, Microsoft, etc.).

​
Creating a restriction

1

Open the Domain Restrictions tab

Go to Settings → Organization → App Policies → Domain Restrictions.
2

Pick an app

Click an app card in Available Apps, or click the + next to an already-restricted app to add another allowed domain.
3

Enter the required domain

Enter a domain like yourcompany.com. Any email whose domain matches exactly will be allowed; everything else will be blocked.
4

Confirm

Click Add Restriction. The restriction is enforced immediately for new OAuth connections.
You can add more than one restriction per app if you want to allow multiple domains (for example, yourcompany.com and yourcompany.co.uk). Each restriction adds one domain to the allowlist for that app.

​
Enable, disable, delete

Each restriction has an Enabled toggle. Disabling a restriction pauses enforcement without deleting the rule, so you can turn it back on later. You can also delete a restriction from its detail page.

​
What end users see

When someone tries to connect an account that doesn’t match, the OAuth flow ends with an error explaining that their organization requires a different email domain for this app. They can retry the connection with an account on an allowed domain.

App Claims

Restrict connections by provider workspace rather than by email domain.

Credentials

Learn how OAuth connections are stored and used across Gumloop.