# Setup checklist

> The five steps on the console's Setup page: domain, GCP project, OAuth client, Workspace admin, run checks. What each one needs and which check closes it.

Source: https://docs.applane.dev/console/setup-checklist/

**Who:** The Applane admin, collecting values from the DNS owner, the GCP admin and the Workspace admin  
**Time:** 10 minutes once the values are in hand

**Setup** is the home screen of the console until every step passes. Each step is a card with a lamp: green passed, red failed, amber warning, hollow not yet checked. Passed steps collapse to their title.

## Step 1: Verify your domain

The TXT record and a **Verify** button. Details on [Verify your domain](https://docs.applane.dev/console/verify-domain/).

## Step 2: Google Cloud project

Two fields: the project id and the builders group email. Once both are filled, **Download applane-setup.sh** generates the script with your values in it, and two links point at the Terraform module and the setup pages for GCP admins.

Hand the script or the links to your GCP admin: [Set up the project](https://docs.applane.dev/gcp-admins/setup/). Nothing is checked from this step; step 5 confirms the APIs and the IAM grant.

## Step 3: OAuth consent screen and client

The two redirect URIs, with copy buttons, and a field for the client id. Your GCP admin creates the client following [OAuth consent screen](https://docs.applane.dev/gcp-admins/oauth-consent-screen/) and [OAuth client](https://docs.applane.dev/gcp-admins/oauth-client/), then gives you the id.

Paste it and click **Test sign-in**. A popup runs Google's sign-in once with that client id, asking for `openid email` only, and returns to `https://admin.applane.dev/oauth-probe`. The token stays in your browser.

| Result | Meaning |
|---|---|
| "Signed in as you@yourdomain. Consent screen and client work." | Done. The id is saved. |
| "Google returned `access_denied`." | The consent screen is not Internal, or the account is outside your organisation. |
| "Google did not return to the console." | The popup shows the error; usually `redirect_uri_mismatch` (check both URIs, trailing slash included) or `invalid_client` (check the id). |
| "The browser blocked the popup." | Allow popups for `admin.applane.dev` and try again. |
| "Signed in as bob@other.com, not at yourdomain." | The client works, but sign in with an account at your domain to be sure the screen is Internal. |

Every error is explained in [Error messages](https://docs.applane.dev/reference/errors/).

## Step 4: Workspace admin

Copy blocks for your Workspace admin: the extension id, the force-install policy JSON with your domain filled in, and the one line about the per-user Apps Script API setting. Send them [Chrome extension policy](https://docs.applane.dev/workspace-admins/chrome-extension-policy/).

Two fields for you: the bot account email and the admin group email, both at your domain. The Workspace admin creates them: [Accounts and groups](https://docs.applane.dev/workspace-admins/accounts-and-groups/). Click **Save**.

## Step 5: Run checks

Click **Run checks**. Each row gets a lamp and a one-line detail.

| Row | Pass reads | On failure |
|---|---|---|
| Domain verified | "yourdomain verified" | Add the TXT record in step 1. |
| Client id saved | "Client id saved" | Paste it in step 3. |
| Test sign-in | "Test sign-in passed" | The probe's error, verbatim. |
| APIs enabled | "5 of 5 APIs enabled on `<GCP_PROJECT_ID>`" | The missing API and the command that enables it. |
| Vertex IAM | "`applane-builders@yourdomain` has `roles/aiplatform.user`" | The `gcloud projects add-iam-policy-binding` line. |
| Apps Script API | "Apps Script API reachable" | The per-user setting link. |
| Extension policy | Manual | Tick **Done** once the Workspace admin has allowed or force-installed the extension. |
| Bot account | Manual | Tick **Done** once `applane-bot@` exists and has a licence. |
| Admin group | Manual | Tick **Done** once `applane-admins@` exists. |

Manual rows record who ticked them and when.

When every row passes: "Setup complete. The first sign-in from the extension will show up under People." The home screen becomes [People](https://docs.applane.dev/console/people-and-seats/) and Setup stays in the navigation without a badge.

## Then

Install the extension and sign in yourself: [Install and sign in](https://docs.applane.dev/builders/install-and-sign-in/). Your seat appears under People within a minute.