Setup checklist

Who

IT or Platform team coordinating DNS, Google Cloud and Workspace setup

Time

10 minutes once the values are in hand

Setup brings the company configuration and checks into one place. Collect the project ID, builders group, OAuth client ID and admin group before you begin. External and public apps also need a bot account.

The checklist shows what passed, what failed and what still needs a manual check. Follow the error on a failed step, then run that check again.

Step 1: Verify your domain

The TXT record and a Verify button. Details on Verify your domain.

Step 2: Google Cloud project

Two fields: the project id and the builders group email. Once both are filled, Download applane-setup.sh generates the script with your values in it, and two links point at the Terraform module and the setup pages for GCP admins.

Hand the script or the links to your GCP admin: Set up the project. Nothing is checked from this step; step 5 confirms the APIs and the IAM grant.

Step 3: OAuth consent screen and client

The two redirect URIs, with copy buttons, and a field for the client id. Your GCP admin creates the client following OAuth consent screen and OAuth client, then gives you the id.

Paste it and click Test sign-in. A popup runs Google’s sign-in once with that client id, asking for openid email only, and returns to https://admin.applane.dev/oauth-probe. The token stays in your browser.

Result	Meaning
“Signed in as you@yourdomain. Consent screen and client work.”	Done. The id is saved.
“Google returned access_denied.”	The consent screen is not Internal, or the account is outside your organisation.
“Google did not return to the console.”	The popup shows the error; usually redirect_uri_mismatch (check both URIs character for character) or invalid_client (check the id).
“The browser blocked the popup.”	Allow popups for admin.applane.dev and try again.
“Signed in as bob@other.com, not at yourdomain.”	The client works, but sign in with an account at your domain to be sure the screen is Internal.

Every error is explained in Error messages.

Step 4: Workspace admin

Two fields: the bot account email and the admin group email, both at your domain. The Workspace admin creates them: Accounts and groups. Click Save.

The step also carries one line you do not act on: builders turn on the Apps Script API themselves, once, at script.google.com/home/usersettings. The builder shows them the link on first run, so it is not a setup step and it is not checked here. Background: Apps Script API setting.

Step 5: Run checks

Click Run checks. Each row gets a lamp and a one-line detail.

Row	Pass reads	On failure
Domain verified	“yourdomain verified”	Add the TXT record in step 1.
Client id saved	“Client id saved”	Paste it in step 3.
Test sign-in	“Test sign-in passed”	The probe’s error, verbatim.
APIs enabled	“5 of 5 APIs enabled on <GCP_PROJECT_ID>”	The missing API and the command that enables it.
Vertex IAM	“applane-builders@yourdomain has roles/aiplatform.user”	The gcloud projects add-iam-policy-binding line.
Bot account	Manual	Tick Done once applane-bot@ exists and has a licence.
Admin group	Manual	Tick Done once applane-admins@ exists.

Manual rows record who ticked them and when.

When every row passes: “Setup complete. The first sign-in from the builder will show up under People.” The home screen becomes People and Setup stays in the navigation without a badge.

Hand over to your first builders

Open the builder and sign in yourself: Open and sign in. Confirm that your seat appears under People, then test an internal app with a colleague before inviting the rest of the team.