Google workspace

Google Admin Console · Chrome Browser Cloud Management

For organizations using Google Workspace (formerly G Suite) with Chrome Browser Cloud Management, you can force-install the AgentKeeper extension and push its managed configuration directly from the Google Admin Console without an MDM.

This path is Chrome-only. For Firefox or Edge, use the OS-level MDM guides.

Prerequisites

• Google Workspace admin access
• Chrome Browser Cloud Management enabled (or Chrome devices enrolled in Workspace)
• An org API key from Settings → Access → API keys (starts with ak_live_)

The AgentKeeper Chrome extension ID is lllalmnahkbikalapoancgfkiegfoiim (shared by Chrome, Edge, Brave, and Arc).

Step 1: Force-install the extension

1. Open the Google Admin Console.
2. Go to Devices → Chrome → Apps & Extensions.
3. Select the organizational unit (OU) you want to target.
4. Click the + button → Add Chrome app or extension by ID.
5. Enter the AgentKeeper extension ID lllalmnahkbikalapoancgfkiegfoiim and click Save.
6. Set Installation policy to Force install.
7. Save.

Step 2: Push managed config

From the same Apps & Extensions page:

1. Click the AgentKeeper entry to open its settings (the panel opens on the right).
2. Under Policy for extensions, paste the following JSON (Google Admin also accepts uploading it as a .txt/.json file):

{
  "orgApiKey": { "Value": "ak_live_xxxxxxxx" },
  "backendUrl": { "Value": "https://www.agentkeeper.dev/api" },
  "userEmail": { "Value": "${user.email}" }
}

Important: Google Admin uses a wrapped format. In the "Policy for extensions" field, each setting must be an object with a "Value" key, as shown above. This differs from the flat { "key": "value" } form used by the Windows registry, macOS property lists, and Firefox policies.json. Pasting the flat form here makes Chrome reject the policy with Discarding policy ... The JSON blob dictionary value is not a dictionary, and the extension never receives its configuration.

Replace ak_live_xxxxxxxx with your organization API key from Settings → Access → API keys. Google Workspace automatically substitutes ${user.email} with the signed-in user's email address. backendUrl is optional because the extension defaults to https://www.agentkeeper.dev/api; set it only for on-premises deployments.

3. Save.

Applying the policy

Policy changes apply to managed Chrome browsers within a few minutes. Users do not need to restart Chrome; the extension installs and enrolls automatically on the next policy refresh.

Verifying the rollout

On a managed Chrome browser:

1. Open chrome://policy. Confirm ExtensionInstallForcelist shows the AgentKeeper entry and the managed config keys appear.
2. Open chrome://extensions. AgentKeeper shows "Installed by your administrator".
3. Extension popup reads "Paired".

See Verifying deployment for the full checklist including dashboard confirmation.