Employee Offboarding Setup Guide

This guide covers everything you need to set up the Employee Offboarding workflow end to end.

Copy the Google Form and Google Sheet

Visit tl-hr.com and enter your license key to access the configurator
Download your pre-configured workflow and copy the Google Form and Google Sheet templates provided
Make copies of both into your Google Workspace account
Note: copying does not carry over the connection between the form and sheet. You will need to reconnect them in Google Forms (Responses tab → Link to Sheets → Select the copied sheet)

Create/Setup Google Cloud Project (if not created yet)

Enable Gmail API

Go to console.cloud.google.com
Select your project
In the left sidebar, go to APIs & Services → Library
Search for Gmail API
Click on Gmail API in the results
Click Enable

Enable Google Sheets API

Go to console.cloud.google.com
Select your project
In the left sidebar, go to APIs & Services → Library
Search for Google Sheets API
Click on Google Sheets API in the results
Click Enable

Create OAuth Consent Screen

Go to APIs & Services → OAuth consent screen
Choose Internal (since this is for internal use)
Click Create
Fill in the required fields:
- App name (e.g. "n8n")
- User support email — select your email from the dropdown
- Developer contact email — enter your email
Click Save and Continue
On the Scopes step, click Save and Continue — you can skip adding scopes here since n8n handles this automatically
Click Back to Dashboard

Create OAuth Client

Go to console.cloud.google.com
Select your project
Go to APIs & Services → Credentials
Click Create credentials → OAuth client ID
Application type → Web application
Name the OAuth client (e.g. "n8n")
Authorized redirect URIs → https://your-n8n.com/rest/oauth2-credential/callback
Click Create
Copy Client ID and Client Secret

Note: You will only see the client secret once, so make sure to copy and/or download the JSON.

Create the Service Account

Go to console.cloud.google.com
Select your project
Go to APIs & Services → Credentials
Click Create Credentials → Service Account
Give it a name (e.g. "n8n-service-account")
Copy the service account email address (e.g. n8n-service-account@project-name.iam.gserviceaccount.com)
Click Create and Continue — skip the optional role and user access steps
Click Done

Create a JSON Key

Click on your newly created service account
Go to the Keys tab
Click Add Key → Create new key
Choose JSON and click Create
The key file will download automatically — keep this safe, you will need it later

Enable Domain-Wide Delegation

Go to the Details tab of your service account
Click the Advanced settings tab
Note the Client ID shown — you will need this in the next step

Authorize in Google Workspace Admin Console

Go to admin.google.com
Go to Security → Access and data control → API controls
Scroll down and click Manage Domain Wide Delegation
Click Add new
Paste in the service account Client ID
Add the following scopes:

https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/userinfo.profile,openid,https://www.googleapis.com/auth/documents,https://www.googleapis.com/auth/spreadsheets,https://www.googleapis.com/auth/admin.chrome.printers,https://mail.google.com/,https://www.googleapis.com/auth/drive.appdata,https://www.googleapis.com/auth/drive.photos.readonly,https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/drive.metadata,https://www.googleapis.com/auth/gmail.labels,https://www.googleapis.com/auth/gmail.addons.current.action.compose,https://www.googleapis.com/auth/gmail.addons.current.message.action,https://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/gmail.compose,https://www.googleapis.com/auth/admin.directory.user

Click Authorize

Note: Domain Wide Delegation can take up to 24 hours to propagate but in my experience it updates fairly immediately.

Connect Credentials in n8n

Create the Gmail Credential

Open your n8n instance
Click Overview in the left sidebar
Click Credentials
Click Create credential in the top right
Search and select Gmail OAuth2 API
Paste your Client ID and Client Secret from the OAuth client step
Click Sign in with Google
A browser window will open. Sign in with the Google Workspace admin account
Grant the requested permissions
You will be redirected back to n8n. The credential will show as connected

Create the Google Sheets Credential

Open your n8n instance
Click Overview in the left sidebar
Click Credentials
Click Create credential in the top right
Search and select Google Sheets OAuth2 API
Paste your Client ID and Client Secret from the OAuth client step
Click Sign in with Google
A browser window will open. Sign in with the Google Workspace admin account
Grant the requested permissions
You will be redirected back to n8n. The credential will show as connected

Create the Google Service Account Credential

Open your n8n instance
Click Overview in the left sidebar
Click Credentials
Click Create credential in the top right
Search and select Google Service Account API
Select the region closest to you (this does not matter)
Open the downloaded JSON key file. Find the Service Account Email (client_email) and paste it into the Service Account Email field
From the downloaded JSON, find the Private Key (private_key) and paste the full value into the private key field (everything between and including -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----\n)
Toggle Impersonate a User on and enter your email (the Google Workspace admin)
Toggle Set up for use in HTTP Request node on
Add the scope: https://www.googleapis.com/auth/admin.directory.user
Set Allowed HTTP Request Domains to All
When all fields are complete, you should see Connection tested successfully

Common errors when setting up the Google Service Account

unauthorized_client

n8n validates all Domain-Wide Delegation scopes when authenticating, not just the ones your workflow uses. If any scope is missing the entire authentication fails. Make sure the full scope list is added exactly as shown in the Google Workspace Admin Console under Security → Access and data control → API controls → Manage Domain Wide Delegation. No extra spaces, no missing scopes.

invalid_grant (Private key validation failed)

This is usually a propagation delay. After setting up or updating Domain-Wide Delegation in the Admin Console, it can take up to a few hours to take effect. If you see this error immediately after setup, wait a few hours and try again before troubleshooting further.

Authorization failed - please check your credentials

The "Set up for use in HTTP Request node" toggle on the Google Service Account credential in n8n is turned off. Open the credential in Settings → Credentials and turn it on. This is required for the credential to work with an HTTP Request node.

Find your Credential IDs in n8n

Each credential you create in n8n has a unique ID. You need these IDs to configure your workflow.

Open your n8n instance
Click Credentials in the left sidebar
Find the credential you need and click on it to open it
Go to the Details tab
Copy the ID field

You need three credential IDs:

Gmail OAuth2 credential ID
Google Sheets OAuth2 credential ID
Google Service Account credential ID

Configure Employee Offboarding Workflow

Go to https://tl-hr.com/configure/employee-offboarding-google-workspace
Enter the passcode (included in your purchase receipt)
Fill in the form:

Field	Description
Company name	Your company name
Google Workspace domain	e.g. `acme.com`
Gmail credential ID	The ID from the Gmail credential in n8n
Google Sheets credential ID	The ID from the Sheets credential in n8n
Google Service Account credential ID	The ID from the Service Account credential in n8n
n8n webhook URL	e.g. `https://your-n8n-instance.com/webhook/employee-offboarding`
Google Sheets ID	The ID from your Google Sheet URL (the long string in `https://docs.google.com/spreadsheets/d/THIS-ID/edit`)
Alert email	Email to receive error messages if the workflow fails
Default IT email	Email for IT services notifications
Default payroll email	Email for payroll/finance notifications

Click Download Workflow JSON to download the configured workflow
Click Download Apps Script to download the configured Google Apps Script file

Import the Apps Script into Google Forms

Go to your copied Google Form
Click the kebab menu button (three dots) on the top right and select Apps Script
In the new window, the Code.gs file should be empty
Open the downloaded employee-offboarding-google-workspace-appscript.gs file in a text editor
Copy and paste the entire contents into the empty Code.gs file
Select setup in the function dropdown and click the Run button
Approve the permissions when prompted
Click Deploy → New deployment
Click Deploy, then Authorize Access
Click Select all to allow the form access to your account

Import the Workflow into n8n

Create a new workflow in n8n
Click the kebab menu button (three dots) on the top right
Select Import from file
Select the downloaded employee-offboarding-google-workspace-configured.json file
Click Publish to set the workflow live

Test the Workflow

Submit a test offboarding entry through your Google Form
Verify that:
- IT receives a notification
- Payroll receives a notification
- The manager receives a notification
- The employee receives a notification
- The Google account is suspended on the employee's last day
- The offboarding is logged in the Google Sheet