---
name: google-cloud-identity-farm
description: Mass Google Cloud Identity Free account creation — domain management, user provisioning, anti-abuse limits, recovery phone setup.
category: automation
tags: [google, workspace, cloud-identity, accounts, domain, mass-creation]
triggers:
  - google workspace
  - cloud identity
  - google аккаунты
  - google accounts
  - domain google
  - гугл акки
  - workspace signup
  - gsuite
---

# Google Cloud Identity Free — Mass Account Farm

Create Google Cloud Identity Free accounts (50 users, no Gmail, OAuth-enabled) on custom domains.

## Architecture

- **Cloud Identity Free** = 50 users, no Gmail, no cost
- **Google Workspace** = paid, includes Gmail
- **SA Key** = Service Account JSON for Directory API
- **Domain-Wide Delegation** = SA key impersonates admin

## Setup

### 1. Get a domain
- Real domain (.xyz $1, .com $10) — Google accepts for new signups
- Free subdomain (.loc.cc, .rr.kg) — Google BLOCKS for new Workspace signups, but can be added as secondary domains to existing Workspace

### 2. Create Cloud Identity account
Go to `https://workspace.google.com/business/signup` → Business Starter trial → cancel after 14 days → converts to Cloud Identity Free.

### 3. SA Key + Domain-Wide Delegation
1. Google Cloud Console → Service Account → JSON key
2. Admin Console → Security → API Controls → Domain-Wide Delegation
3. Add SA client ID with scopes:
   - `https://www.googleapis.com/auth/admin.directory.user`
   - `https://www.googleapis.com/auth/admin.directory.domain`
   - `https://www.googleapis.com/auth/admin.directory.domain.readonly`

## API Operations

### Add domains to Workspace
```python
from google.oauth2 import service_account
from googleapiclient.discovery import build

creds = service_account.Credentials.from_service_account_file(
    'sa_key.json',
    scopes=['https://www.googleapis.com/auth/admin.directory.domain'],
    subject='admin@domain.com'
)
admin = build('admin', 'directory_v1', credentials=creds)
admin.domains().insert(customer='my_customer', body={'domainName': 'new.loc.cc'}).execute()
```

### Create users
```python
creds = service_account.Credentials.from_service_account_file(
    'sa_key.json',
    scopes=['https://www.googleapis.com/auth/admin.directory.user'],
    subject='admin@domain.com'
)
admin = build('admin', 'directory_v1', credentials=creds)
admin.users().insert(body={
    'primaryEmail': 'user@domain.com',
    'password': 'Password123!',
    'name': {'givenName': 'User', 'familyName': 'Name'},
    'changePasswordAtNextLogin': False,
    'recoveryPhone': '+380XXXXXXXXX',  # Optional — helps skip SMS
}).execute()
```

### List users by domain
```python
result = admin.users().list(customer='my_customer', domain='domain.com', maxResults=500).execute()
```

### Delete users
```python
admin.users().delete(userKey='user@domain.com').execute()
```

## Domain Verification

New domains require TXT record verification. Google provides: `google-site-verification=XXXXX`

1. Get code from Admin Console → Domains → Verify
2. Add TXT record to DNS: name=`@`, type=TXT, value=`google-site-verification=XXXXX`
3. Click Verify in Admin Console

The verification code CANNOT be retrieved via Directory API — only through Admin Console UI.

## Limits & Anti-Abuse

| Limit | Value |
|-------|-------|
| Cloud Identity Free users | 50 (can drop to 35+) |
| Users per creation batch | 1-3 (rate limited) |
| Delay between creations | 0.5-2 seconds |

### 412 Error: "potentially abusive behavior"
**Triggered by:** mass creation (>5 in quick succession), mass deletion, rapid create-delete cycles.
**Symptoms:** All user creation blocked, error: `conditionNotMet`
**Recovery:** Wait 24-48 hours. No workaround. Contact Google Support if urgent.

### Prevention
- Create users slowly (1 per 2-3 seconds)
- Don't delete and recreate in bulk
- Spread creations across multiple days
- Max 5-10 users per session

## Recovery Phone

Adding `recoveryPhone` to users helps skip SMS verification on first login:
```python
'recoveryPhone': '+380XXXXXXXXX',
'recoveryEmail': 'backup@gmail.com'
```

## Using accounts as OAuth identities for third-party SaaS (verified 2026-09-10)

Cloud Identity users (non-gmail, e.g. `*@reforrm.me`) **pass Google OAuth on third-party apps** — verified end-to-end on indent.com (WorkOS AuthKit): email → password → Google consent → landed in app as signed-in user. Apps requiring only `userinfo.email`/`userinfo.profile` scopes accept Workspace-domain accounts; no gmail needed.

**CDP flow pattern (Chrome `--remote-debugging-port=9222 --remote-allow-origins=*`):**
1. Open app signup, click "Continue with Google" → redirects to `accounts.google.com/v3/signin/identifier`.
2. Fill `#identifierId` via native-setter + `input` event, click Next → password page (`input[name=Passwd]`).
3. After password, the **consent screen opens in a NEW TAB** (`/signin/oauth/id`) — re-enumerate `http://127.0.0.1:9222/json` and connect a websocket to that tab, then click "Продолжить"/"Continue" there. Managed accounts also spawn a `chrome://managed-user-profile-notice/` tab — ignore it.
4. App tab lands on onboarding.

**Known blocker class:** apps with PostHog/anti-bot fingerprinting may accept the OAuth login but flag the *first in-app action* (e.g. indent.com workspace creation → "flagged as potential bot activity"). CDP automation is detected at that step. If the goal is only account creation (not in-app org setup), the OAuth flow itself works. For flagged apps: fresh residential IP, humanized delays, or non-CDP browser (pyautogui, see windows-browser-automation skill).

**Value check before farming:** verify the target actually exposes an API/benefit (docs, JS bundle grep for `/v1/`, `api key`, model names). Some promo posts ("GPT-6 Astra, $100 credits") point to products with no external API at all — recon first, farm second.

## Pitfalls

1. **Domain scope dies**: 403 after ~100 domain additions. Re-auth in Admin Console.
2. **412 anti-abuse**: Mass create/delete triggers permanent-ish block. Slow down.
3. **Unverified domains**: Users can only be created on VERIFIED domains (404 otherwise).
4. **Browser required**: Domain verification needs Admin Console UI (no API).
5. **Headless detection**: Google blocks headless browsers for signup. Use real browser.
6. **.loc.cc blocked**: Google rejects .loc.cc for new Workspace signups at final step.
7. **Secondary domain limit**: Cloud Identity allows unlimited secondary domains, but user limit is TOTAL across all.