How do I create the OAuth client for Applane?

Who

GCP admin

Time

3 minutes

Open APIs & Services > Credentials > Create credentials > OAuth client ID.

Field	Value
Application type	Web application. Not “Chrome extension”: that type only works with Chrome’s getAuthToken, while Applane uses launchWebAuthFlow, which also works in Edge and Brave.
Name	Applane extension
Authorised JavaScript origins	Leave empty.
Authorised redirect URIs	Exactly two, below.

The two redirect URIs:

https://<APPLANE_EXTENSION_ID>.chromiumapp.org/
https://admin.applane.dev/oauth-probe

The first is where the extension’s sign-in returns. It is built from the extension’s fixed id, so it is the same for every customer. Keep the trailing slash.

The second is where the Applane console’s Test sign-in button returns. That test runs the sign-in flow once with openid email only, from the admin’s browser, and names the exact Google error if there is one. The token never leaves the browser.

Copy both from the Applane console’s Setup page rather than typing them. Add nothing else.

Click Create and copy the Client ID (it ends in .apps.googleusercontent.com). The client secret is not used: the extension signs in with the implicit flow, which has no secret.

Paste it into the Applane console

Setup > OAuth consent screen and client > Client id, then Test sign-in. A green “Signed in as you@yourdomain. Consent screen and client work.” means both steps are done. See Setup checklist.

If you rotate or delete the client

Every employee’s next sign-in fails with invalid_client. Create the new client the same way, paste the new id into the console, and builders pick it up at their next sign-in. Do not delete the old one until the new id is saved.

If sign-in fails

Error on the Google page	Cause	Fix
redirect_uri_mismatch	A URI is missing or differs (trailing slash, http, a typo in the id).	Paste both URIs exactly as the console shows them; retry after a minute.
invalid_client	Wrong client id in the Applane console, or the client was deleted.	Copy the Client ID again; check for a trailing space.
access_denied	Consent screen not Internal, account outside your organisation, or the app is blocked by a Workspace admin.	Set the user type to Internal; use a work account; ask the Workspace admin to check API controls.
admin_policy_enforced	Third-party apps are restricted to a trusted list.	Workspace admin: Third-party app access.
org_internal	A personal or external Google account.	Expected. Use a work account.

The same table with the builder-side errors is in Error messages.