Setup checklist

Who

The Applane admin, collecting values from the DNS owner, the GCP admin and the Workspace admin

Time

10 minutes once the values are in hand

Setup is the home screen of the console until every step passes. Each step is a card with a lamp: green passed, red failed, amber warning, hollow not yet checked. Passed steps collapse to their title.

Step 1: Verify your domain

The TXT record and a Verify button. Details on Verify your domain.

Step 2: Google Cloud project

Two fields: the project id and the builders group email. Once both are filled, Download applane-setup.sh generates the script with your values in it, and two links point at the Terraform module and the setup pages for GCP admins.

Hand the script or the links to your GCP admin: Set up the project. Nothing is checked from this step; step 5 confirms the APIs and the IAM grant.

Step 3: OAuth consent screen and client

The two redirect URIs, with copy buttons, and a field for the client id. Your GCP admin creates the client following OAuth consent screen and OAuth client, then gives you the id.

Paste it and click Test sign-in. A popup runs Google’s sign-in once with that client id, asking for openid email only, and returns to https://admin.applane.dev/oauth-probe. The token stays in your browser.

Result	Meaning
“Signed in as you@yourdomain. Consent screen and client work.”	Done. The id is saved.
“Google returned access_denied.”	The consent screen is not Internal, or the account is outside your organisation.
“Google did not return to the console.”	The popup shows the error; usually redirect_uri_mismatch (check both URIs, trailing slash included) or invalid_client (check the id).
“The browser blocked the popup.”	Allow popups for admin.applane.dev and try again.
“Signed in as bob@other.com, not at yourdomain.”	The client works, but sign in with an account at your domain to be sure the screen is Internal.

Every error is explained in Error messages.

Step 4: Workspace admin

Copy blocks for your Workspace admin: the extension id, the force-install policy JSON with your domain filled in, and the one line about the per-user Apps Script API setting. Send them Chrome extension policy.

Two fields for you: the bot account email and the admin group email, both at your domain. The Workspace admin creates them: Accounts and groups. Click Save.

Step 5: Run checks

Click Run checks. Each row gets a lamp and a one-line detail.

Row	Pass reads	On failure
Domain verified	“yourdomain verified”	Add the TXT record in step 1.
Client id saved	“Client id saved”	Paste it in step 3.
Test sign-in	“Test sign-in passed”	The probe’s error, verbatim.
APIs enabled	“5 of 5 APIs enabled on <GCP_PROJECT_ID>”	The missing API and the command that enables it.
Vertex IAM	“applane-builders@yourdomain has roles/aiplatform.user”	The gcloud projects add-iam-policy-binding line.
Apps Script API	“Apps Script API reachable”	The per-user setting link.
Extension policy	Manual	Tick Done once the Workspace admin has allowed or force-installed the extension.
Bot account	Manual	Tick Done once applane-bot@ exists and has a licence.
Admin group	Manual	Tick Done once applane-admins@ exists.

Manual rows record who ticked them and when.

When every row passes: “Setup complete. The first sign-in from the extension will show up under People.” The home screen becomes People and Setup stays in the navigation without a badge.

Then

Install the extension and sign in yourself: Install and sign in. Your seat appears under People within a minute.