# How do I create the OAuth client for Applane?

> A Web application client with two redirect URIs: the extension's chromiumapp.org URL and the console's oauth-probe. No JavaScript origins, no secret.

Source: https://docs.applane.dev/gcp-admins/oauth-client/

**Who:** GCP admin  
**Time:** 3 minutes

Open **APIs & Services > Credentials > Create credentials > OAuth client ID**.

| Field | Value |
|---|---|
| Application type | **Web application**. Not "Chrome extension": that type only works with Chrome's `getAuthToken`, while Applane uses `launchWebAuthFlow`, which also works in Edge and Brave. |
| Name | `Applane extension` |
| Authorised JavaScript origins | Leave empty. |
| Authorised redirect URIs | Exactly two, below. |

The two redirect URIs:

```text
https://<APPLANE_EXTENSION_ID>.chromiumapp.org/
https://admin.applane.dev/oauth-probe
```

The first is where the extension's sign-in returns. It is built from the extension's fixed id, so it is the same for every customer. Keep the trailing slash.

The second is where the Applane console's **Test sign-in** button returns. That test runs the sign-in flow once with `openid email` only, from the admin's browser, and names the exact Google error if there is one. The token never leaves the browser.

Copy both from the Applane console's Setup page rather than typing them. Add nothing else.

Click **Create** and copy the **Client ID** (it ends in `.apps.googleusercontent.com`). The client secret is not used: the extension signs in with the implicit flow, which has no secret.

## Paste it into the Applane console

**Setup > OAuth consent screen and client > Client id**, then **Test sign-in**. A green "Signed in as you@yourdomain. Consent screen and client work." means both steps are done. See [Setup checklist](https://docs.applane.dev/console/setup-checklist/).

## If you rotate or delete the client

Every employee's next sign-in fails with `invalid_client`. Create the new client the same way, paste the new id into the console, and builders pick it up at their next sign-in. Do not delete the old one until the new id is saved.

## If sign-in fails

| Error on the Google page | Cause | Fix |
|---|---|---|
| `redirect_uri_mismatch` | A URI is missing or differs (trailing slash, `http`, a typo in the id). | Paste both URIs exactly as the console shows them; retry after a minute. |
| `invalid_client` | Wrong client id in the Applane console, or the client was deleted. | Copy the Client ID again; check for a trailing space. |
| `access_denied` | Consent screen not Internal, account outside your organisation, or the app is blocked by a Workspace admin. | Set the user type to Internal; use a work account; ask the Workspace admin to check API controls. |
| `admin_policy_enforced` | Third-party apps are restricted to a trusted list. | Workspace admin: [Third-party app access](https://docs.applane.dev/workspace-admins/third-party-app-access/). |
| `org_internal` | A personal or external Google account. | Expected. Use a work account. |

The same table with the builder-side errors is in [Error messages](https://docs.applane.dev/reference/errors/).