# How do I verify the Applane GCP setup?

> Run applane-setup.sh --check for the APIs, IAM and billing, then Run checks in the Applane console for the domain, OAuth client and Apps Script API.

Source: https://docs.applane.dev/gcp-admins/verify/

**Who:** GCP admin for the terminal check; the Applane admin for the console check  
**Time:** 3 minutes

## From the terminal

```bash
./applane-setup.sh --check --project <GCP_PROJECT_ID> --group applane-builders@<YOUR_DOMAIN>
```

It checks what `gcloud` can see and changes nothing:

| Line | What it checks |
|---|---|
| `PASS API enabled: ...` x5 | Each of the [five APIs](https://docs.applane.dev/gcp-admins/apis/) is on. |
| `PASS IAM: roles/aiplatform.user -> group:...` | The [IAM grant](https://docs.applane.dev/gcp-admins/iam/) exists. |
| `PASS Billing linked to ...` | The project has a billing account. |
| `INFO Apps Script API user setting` | Cannot be checked from here; per user. |
| `INFO OAuth consent screen and client` | Cannot be checked from here; Google has no API for it. |

A `FAIL` line prints the command that fixes it.

## From the Applane console

The Applane admin opens **Setup > Run checks**. The checker runs from their browser and from Applane's backend, each checking what it can see, and stores only pass or fail.

| Check | How | If it fails |
|---|---|---|
| Domain verified | DNS TXT lookup | The record to add. [Verify your domain](https://docs.applane.dev/console/verify-domain/) |
| Client id saved | The tenant record | Paste it. [OAuth client](https://docs.applane.dev/gcp-admins/oauth-client/) |
| Test sign-in passed | The sign-in flow once, from the admin's browser, `openid email` only, returning to `https://admin.applane.dev/oauth-probe` | The Google error, verbatim. [Error messages](https://docs.applane.dev/reference/errors/) |
| Five APIs enabled | Asks Google which services are on, with the admin's token from that one sign-in | The missing API and the `gcloud services enable` line |
| `roles/aiplatform.user` granted | Tests the binding with the admin's token | The `gcloud projects add-iam-policy-binding` line |
| Apps Script API reachable | A probe call | The per-user setting link. [Apps Script API](https://docs.applane.dev/workspace-admins/apps-script-api/) |
| Extension allowed or force-installed | Manual: the Workspace admin ticks it | [Chrome extension policy](https://docs.applane.dev/workspace-admins/chrome-extension-policy/) |
| Bot account and admin group exist | Manual: the Workspace admin ticks it | [Accounts and groups](https://docs.applane.dev/workspace-admins/accounts-and-groups/) |

The admin's Google token from the test sign-in is used inside their browser session and is not sent to Applane.

## The real test

Install the extension, sign in, and build one app. If your seat appears under **People** in the console and the app opens at its `script.google.com` URL, everything is set up. [Install and sign in](https://docs.applane.dev/builders/install-and-sign-in/), [Your first app](https://docs.applane.dev/builders/first-app/).