How do I set up the OAuth consent screen for Applane?

Who

GCP admin

Time

3 minutes

Google has no API for this screen, so it is done in the Cloud console. Open APIs & Services > OAuth consent screen. On newer consoles it is Google Auth Platform > Branding and Audience.

Field	Value
User type (Audience)	Internal. Only accounts in your Workspace organisation can sign in. This is what removes Google’s verification and the “unverified app” warning. See No Google app verification needed.
App name	Applane (<YOUR_COMPANY>). Employees see it on the consent screen and in their third-party access list; your Workspace admin sees it under the same name.
User support email	Your IT or helpdesk address.
Developer contact	The same address.
App logo	Optional. A logo on an Internal app triggers no review.
Authorised domains	Leave empty. Not needed for Internal apps.
Scopes	Add none. The extension requests its scopes at sign-in; Internal apps may use any scope.

Save. If the console offers a “Publishing status”, Internal apps have none; there is nothing to publish.

The scopes the extension will request

You do not add them here, but you will see them on the consent screen at first sign-in, under your app name.

Scope	Google’s class	Why
openid, email	non-sensitive	Sign the employee in and check the account belongs to your domain. Any other account is rejected.
https://www.googleapis.com/auth/script.projects	sensitive	Create each app’s Apps Script project and push its files.
https://www.googleapis.com/auth/script.deployments	sensitive	Create and update the web-app deployment that gives each app its URL.
https://www.googleapis.com/auth/script.processes	sensitive	Read execution history, so a builder is told when a scheduled run failed.
https://www.googleapis.com/auth/spreadsheets	sensitive	Read sheet schemas while building; read-write apps write to sheets as the viewer.
https://www.googleapis.com/auth/drive.readonly	restricted	List the apps shared with a builder and read the files they point the agent at. Never writes.
https://www.googleapis.com/auth/cloud-platform	sensitive	Call Vertex AI in your project as the builder, so usage is billed to you. A token is only as powerful as the builder’s own IAM.

More on each in the Scopes reference. The cloud-platform scope is the one reviewers ask about; the answer is in Where things are stored and the security page.

If a builder sees access_denied

The consent screen is not Internal, or the account is outside your organisation. Check the user type here, and that the builder used a work account. Full table in Error messages.

Next: OAuth client.