Skip to content

Set Gmail signatures for all users with GAM or the API

How Google Workspace admins push a signature to every user with the Gmail API or GAM, which scopes it needs, and what breaks.
The Sendoff team2 min read

A Google Workspace admin sets everyone's Gmail signature through the Gmail API method users.settings.sendAs.update (or patch), using a service account with domain-wide delegation and the gmail.settings.basic scope. GAM, the open-source admin command line, wraps that call, so one command with a CSV of users can write a personal signature for the whole domain. Gmail cleans the HTML when it saves it, and signatures are capped at 10,000 characters.

What the API does

Each address a person can send from, their primary address and any aliases, is a sendAs identity with its own signature. Updating the signature field on that identity is the same as the user editing it in Gmail settings. See sendAs in the glossary.

You need:

  1. A Google Cloud project with the Gmail API turned on.
  2. A service account with domain-wide delegation, authorised in the Admin console under Security > API controls.
  3. The scope https://www.googleapis.com/auth/gmail.settings.basic. Changes to aliases other than the primary address need the service account acting with domain-wide authority.

With GAM

GAM (and its extended version, GAMADV-XTD3) can set a signature from a string or an HTML file, for one user, a group or every user. A common pattern is an HTML template with placeholders, plus a CSV of names and titles, so each person gets their own details. Commands differ between GAM versions, so copy the exact syntax from the GAMADV-XTD3 wiki page on send-as signatures rather than from an old forum post.

What tends to break

  • The HTML is sanitized. Gmail strips some tags and styles on save. Test with one account before running it for everyone.
  • The 10,000-character limit. Long inline styles or base64 images push past it. See signature size limits.
  • Images must be hosted. Use public HTTPS URLs.
  • New hires and title changes. The script has to run again, or the signature goes stale. See update signatures when titles change.

Without a script

Sendoff does this through the same Gmail API. On the Team plan, you connect Google Workspace, it syncs people from your directory, and Deploy writes each person's signature, aliases included. Nothing to maintain, and your mail never passes through Sendoff. See Google Workspace company signatures.

FAQ

Which scope do I need to set Gmail signatures? gmail.settings.basic is enough to update the signature on a sendAs identity.

Can I set signatures for every user without them signing in? Yes, with a service account that has domain-wide delegation.

Does Gmail keep my HTML exactly? No. Gmail sanitizes signature HTML when it saves it, so test the result.

Sources

Make yours now

Every Sendoff template is built to the rules in these guides. Free, no account needed.

Make my signature