Fix “Sync failed”
When a sync doesn't complete it is almost always one of five things. Check them in this order.
A failed connection shows as Sync failed in Settings → Connection. A sync you start by hand also shows the error in a message on the Contacts page. If the hourly sync fails three times in a row, the admins get an email: Action needed: we can’t sync your directory, with a Fix the connection button.
Work down this list; the first three cover nearly every case.
| Cause | What to do |
|---|---|
| Google hasn’t applied the change yet | Right after you authorise the service account, Google needs two to five minutes, occasionally up to 30. The error mentions unauthorized_client. Wait; the hourly sync retries by itself, or press Sync from Google Workspace on Contacts. |
| The key was saved by someone who isn’t a super admin | Workspace Sync reads the directory on behalf of the person who saved the key; the error mentions invalid_grant. In Settings → Connection, press Disconnect, and have an admin who is also a Google Workspace super admin upload the key again. If none of your admins is a super admin, ask us in the chat. |
| The key is from a different Google Workspace | The key must come from a service account in your organization’s Workspace. Press Disconnect and upload the right key. |
| Wrong Client ID or scope | In the Google Admin console → Manage Domain-wide Delegation, check the Client ID is your service account’s and the scope is exactly https://www.googleapis.com/auth/admin.directory.user.readonly, without typos. |
| Admin SDK API not enabled | In the Google Cloud Console, open APIs & Services → Library, find Admin SDK API and press Enable. |
Disconnect removes the saved key and brings the Setup guide back. Contacts that were already synced stay; syncs pause until you reconnect.
Still failing?
Open the chat with the chat button in the bottom-right corner of this page and tell us the time of the failed sync. We can see the exact error on our side and will tell you which of these it is.
Already-synced people are not affected by a failed sync. They stay in the directory; only new changes wait until the next successful run.