# How do I set up the OAuth consent screen for Applane?

> User type Internal, your own app name, your IT address as contact, no scopes added. Internal removes Google's verification and the unverified-app warning.

Source: https://docs.applane.dev/gcp-admins/oauth-consent-screen/

**Who:** GCP admin  
**Time:** 3 minutes

Google has no API for this screen, so it is done in the Cloud console. Open **APIs & Services > OAuth consent screen**. On newer consoles it is **Google Auth Platform > Branding** and **Audience**.

| Field | Value |
|---|---|
| User type (Audience) | **Internal**. Only accounts in your Workspace organisation can sign in. This is what removes Google's verification and the "unverified app" warning. See [No Google app verification needed](https://docs.applane.dev/gcp-admins/no-verification-needed/). |
| App name | `Applane (<YOUR_COMPANY>)`. Employees see it on the consent screen and in their third-party access list; your Workspace admin sees it under the same name. |
| User support email | Your IT or helpdesk address. |
| Developer contact | The same address. |
| App logo | Optional. A logo on an Internal app triggers no review. |
| Authorised domains | Leave empty. Not needed for Internal apps. |
| Scopes | Add none. The extension requests its scopes at sign-in; Internal apps may use any scope. |

Save. If the console offers a "Publishing status", Internal apps have none; there is nothing to publish.

## The scopes the extension will request

You do not add them here, but you will see them on the consent screen at first sign-in, under your app name.

| Scope | Google's class | Why |
|---|---|---|
| `openid`, `email` | non-sensitive | Sign the employee in and check the account belongs to your domain. Any other account is rejected. |
| `https://www.googleapis.com/auth/script.projects` | sensitive | Create each app's Apps Script project and push its files. |
| `https://www.googleapis.com/auth/script.deployments` | sensitive | Create and update the web-app deployment that gives each app its URL. |
| `https://www.googleapis.com/auth/script.processes` | sensitive | Read execution history, so a builder is told when a scheduled run failed. |
| `https://www.googleapis.com/auth/spreadsheets` | sensitive | Read sheet schemas while building; read-write apps write to sheets as the viewer. |
| `https://www.googleapis.com/auth/drive.readonly` | restricted | List the apps shared with a builder and read the files they point the agent at. Never writes. |
| `https://www.googleapis.com/auth/cloud-platform` | sensitive | Call Vertex AI in your project as the builder, so usage is billed to you. A token is only as powerful as the builder's own IAM. |

More on each in the [Scopes reference](https://docs.applane.dev/security/scopes/). The `cloud-platform` scope is the one reviewers ask about; the answer is in [Where things are stored](https://docs.applane.dev/security/where-things-are-stored/) and the security page.

## If a builder sees `access_denied`

The consent screen is not Internal, or the account is outside your organisation. Check the user type here, and that the builder used a work account. Full table in [Error messages](https://docs.applane.dev/reference/errors/).

Next: [OAuth client](https://docs.applane.dev/gcp-admins/oauth-client/).