> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/kms-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/kms-support/google-cse-integration/cse-integration-guideline.md).

# CSE Integration Guideline

### Enable Google Workspace Client-side Encryption (CSE) with **Oten KMS** <a href="#enable-google-workspace-client-side-encryption-cse-with-oten-kms" id="enable-google-workspace-client-side-encryption-cse-with-oten-kms"></a>

**Audience:** Workspace Admin / Oten KMS Admin\
**Purpose:** Connect your Google Workspace with Oten KMS and Oten IDP so your users can encrypt and access client-side encrypted files (Docs, Sheets, Slides, Drive, Gmail, Meet, Calendar) using your organization-owned encryption keys.

#### Overview <a href="#overview" id="overview"></a>

| **Oten KMS**         | External Key Service (KACLS) controlling Customer-Managed Keys (CMKs)               |
| -------------------- | ----------------------------------------------------------------------------------- |
| **Oten IDP**         | Identity Provider verifying user identity and workspace membership                  |
| **Google Workspace** | Service requesting data-encryption keys (DEKs) from **Oten KMS** via Google CSE API |

## Set up **Oten KMS** KACLS Service for Google Workspace

#### **Start Using Oten KMS for Business – Set Up an Oten Business Account**

{% embed url="<https://app.supademo.com/embed/cmj2ps49x114sv3e5iks6vju5?embed_v=2&utm_source=embed>" %}

#### Step 1: Create an Oten Business Account

1. Sign up for an **Oten Business account**.
2. Create or select an **Oten Organization**.
3. Ensure at least **one workspace** is created within the organization.

#### Step 2: Enable **Oten KMS** for Your Workspace

1. Log in to the **Oten Portal** using your Oten IDP account.
2. Navigate to **Oten KMS Settings**.
3. Activate **Oten KMS** for your organization or selected workspace.
4. Create initial encryption keys (default KEK).

#### Step 3: Retrieve Required Configuration Information

From the **Oten KMS → CSE Configuration** page, copy the following:

* **Oten IDP URL**
* **Client ID**
* **Oten KMS KACLS Service URL**

You will use these values in the Google Admin Console.

### **Oten KMS – Google Workspace CSE Integration**

{% embed url="<https://app.supademo.com/embed/cmj6m17670ujfbyg7725neg2e?embed_v=2&utm_source=embed>" %}

#### Step 4: Configure Google Workspace for CSE

1. Log in to **admin.google.com** with a **Google Workspace Admin** account.
2. Ensure your Google Workspace is on an **Enterprise plan** that supports CSE.
3. Navigate to:

   ```
   Security → Data → Compliance → Client-side encryption
   ```
4. Configure:
   * **Identity Provider (IDP)** using the Oten IDP URL
   * **Key Access Control List Service (KACLS)** using the **Oten KMS** KACLS URL

#### **Step 5: For Configure iDP fallback:**

{% embed url="<https://app.supademo.com/demo/cmny37y3a0cac1q1eih99k4lm?utm_source=link>" %}

#### Step 6: Verify & Start Using Encrypted Files

1. Create or open a Google Docs/Sheets/Drive file.
2. Enable **Client-Side Encryption**.
3. Confirm that encryption keys are managed via **Oten KMS**.
4. View encrypted file activity in the **Oten KMS Portal**.

✅ You’re ready to use Google CSE with **Oten KMS**