The Google Workspace domain whose users may sign in, for example example.com. Logins are rejected unless the verified ID token's hd claim equals this domain, so accounts from other domains and consumer Google accounts can never sign in.