Yes, you will need to use the federated login (OpenID) stuff. The long-and-short of it is that you pass the federated_identity parameter to users.create_login_url. You'll need to setup a page for users to tell you what goes in federated_identity somehow, perhaps by clicking a google logo or entering an apps domain. For Google accounts: users.create_login_url(federated_identity='google.com/accounts/o8/id') or users.create_login_url(federated_identity='gmail.com') For an Apps account: users.create_login_url(federated_identity='google.com/accounts/o8/site-xrds?hd=yourappsdomain.com') There is a little info here: http://code.google.com/appengine/docs/python/users/overview.html And Wesley has a nice article about it here: http://code.google.com/appengine/articles/openid.html Some info on Google Apps domains and OpenID: http://groups.google.com/group/google-federated-login-api/web/openid-...
