# Applane docs

> Applane builds internal web apps from a plain-language description and deploys them to Google Apps Script inside the customer’s own Google Workspace. These docs cover setup for Google Workspace admins, GCP admins and Applane console admins, the builder’s workflow, and security and data.

Last updated: 2026-08-29

Every page is also served as Markdown at the same path with a `.md` suffix. The whole site in one file: https://docs.applane.dev/llms-full.txt

## Start here

- [What Applane is](https://docs.applane.dev/index.md): Applane is a Chrome extension that turns a plain-language description into an internal web app deployed to Google Apps Script in your own Workspace.
- [What runs where](https://docs.applane.dev/start/what-runs-where.md): Applane runs in three places: the employee's Chrome, your Google (Workspace plus one GCP project), and Applane's backend, which holds config and licences.
- [Who does what](https://docs.applane.dev/start/who-does-what.md): Applane setup is eight steps across four roles: Applane admin, DNS owner, GCP admin and Workspace admin. About an hour for one person with every right.
- [The one-hour setup path](https://docs.applane.dev/start/one-hour-setup.md): The fastest order for Applane setup when one person holds every right: DNS first, then groups, GCP project, OAuth, Chrome policy, checker, first app.

## For Google Workspace admins

- [What does Google Workspace need for Applane?](https://docs.applane.dev/workspace-admins/prerequisites.md): A Workspace edition with Apps Script and Chrome management, Apps Script on as a core service, and a GCP project inside the same organisation.
- [How do I force-install the Applane extension with Google Admin?](https://docs.applane.dev/workspace-admins/chrome-extension-policy.md): Add the Applane extension id in the Google Admin console Chrome settings and choose Force install or Allow install. The same policy as JSON is on the page.
- [Why does Apps Script return 403, and how do I turn on the Apps Script API?](https://docs.applane.dev/workspace-admins/apps-script-api.md): Each builder turns on Google Apps Script API once at script.google.com/home/usersettings. Until then every Apps Script API call for that user returns 403.
- [Does Applane need to be a trusted app in Google Workspace?](https://docs.applane.dev/workspace-admins/third-party-app-access.md): Not for the extension: its OAuth client is yours. Only the admin console's Google sign-in may need trusting if API controls block third-party apps.
- [Which accounts and groups does Applane use?](https://docs.applane.dev/workspace-admins/accounts-and-groups.md): Three Workspace identities: a builders group for the Vertex AI role, an admin group made editor on every published app, and a bot account for public apps.
- [Which Drive sharing settings does Applane need?](https://docs.applane.dev/workspace-admins/drive-sharing.md): Internal apps need nothing. Partner and public apps need external or link sharing allowed for the builders' OU. Applane never changes the policy itself.
- [What happens to Applane apps when a builder leaves?](https://docs.applane.dev/workspace-admins/offboarding.md): The apps keep running. Transfer the leaver's Drive files, remove them from the builders group, and reclaim the seat in the Applane console.
- [How do I remove Applane?](https://docs.applane.dev/workspace-admins/uninstall.md): Remove the Chrome policy, the IAM grant and the OAuth client, cancel the subscription and close the tenant. The apps keep running in your Apps Script.

## For GCP admins

- [What does the GCP project need for Applane?](https://docs.applane.dev/gcp-admins/prerequisites.md): One project inside your Workspace organisation, with billing linked and owner or editor rights. Vertex AI needs billing; an existing project is fine.
- [Do I need Google app verification for Applane?](https://docs.applane.dev/gcp-admins/no-verification-needed.md): No. The OAuth client is yours and its consent screen is Internal, which Google exempts from verification and CASA. Applane owns no client with your data.
- [How do I set up the GCP project for Applane?](https://docs.applane.dev/gcp-admins/setup.md): Four ways to prepare the project: Cloud Shell, Infrastructure Manager, Terraform or a script. Each enables five APIs, grants one role, adds a budget alert.
- [Open in Cloud Shell](https://docs.applane.dev/gcp-admins/setup/cloud-shell.md): A guided Cloud Shell walkthrough that picks the project, enables the five APIs, runs applane-setup.sh and links the two console steps. Nothing to install.
- [Infrastructure Manager](https://docs.applane.dev/gcp-admins/setup/infrastructure-manager.md): Google's managed Terraform runs the Applane module from git and keeps the state in your project. Needs one service account and roles/config.admin.
- [Terraform](https://docs.applane.dev/gcp-admins/setup/terraform.md): Add the customer-gcp module to your own Terraform: five APIs, one IAM binding and an optional budget. Verified with Terraform 1.15 and google 6.50.
- [Script](https://docs.applane.dev/gcp-admins/setup/script.md): applane-setup.sh enables the five APIs, grants roles/aiplatform.user to your builders group and adds a budget alert. Add-only, with --dry-run and --check.
- [Which Google APIs does Applane need?](https://docs.applane.dev/gcp-admins/apis.md): Five: Apps Script, Vertex AI, Sheets, Drive and Docs. Google checks API enablement on the project that owns the OAuth client, so all five go on there.
- [Which IAM role do Applane builders need?](https://docs.applane.dev/gcp-admins/iam.md): One: roles/aiplatform.user on the project, granted to the builders Google Group. No service accounts, no keys, no other bindings.
- [How do I set up the OAuth consent screen for Applane?](https://docs.applane.dev/gcp-admins/oauth-consent-screen.md): User type Internal, your own app name, your IT address as contact, no scopes added. Internal removes Google's verification and the unverified-app warning.
- [How do I create the OAuth client for Applane?](https://docs.applane.dev/gcp-admins/oauth-client.md): A Web application client with two redirect URIs: the extension's chromiumapp.org URL and the console's oauth-probe. No JavaScript origins, no secret.
- [How do I set a budget alert for Vertex AI spend?](https://docs.applane.dev/gcp-admins/budget-alerts.md): Create a budget on the billing account with alerts at 50%, 90% and 100% of a monthly amount. The default is 50; alerts only, nothing is cut off.
- [What does Applane cost on Vertex AI?](https://docs.applane.dev/gcp-admins/model-cost.md): Google bills Gemini tokens to your project at list price; Applane adds no fee. A full build day measured $0.59 uncached; context caching cuts most turns.
- [How do I verify the Applane GCP setup?](https://docs.applane.dev/gcp-admins/verify.md): Run applane-setup.sh --check for the APIs, IAM and billing, then Run checks in the Applane console for the domain, OAuth client and Apps Script API.

## For Applane admins (the console)

- [How do I sign up for Applane?](https://docs.applane.dev/console/sign-up.md): Sign in at admin.applane.dev with a Google work account and name the company. That starts a 14-day trial for up to 10 builders, with no card.
- [How do I verify my domain in Applane?](https://docs.applane.dev/console/verify-domain.md): Add one TXT record at the domain apex with the value applane-verify=<TOKEN> shown in the console, then click Verify. DNS takes minutes to a day.
- [Setup checklist](https://docs.applane.dev/console/setup-checklist.md): The five steps on the console's Setup page: domain, GCP project, OAuth client, Workspace admin, run checks. What each one needs and which check closes it.
- [How do seats work in Applane?](https://docs.applane.dev/console/people-and-seats.md): A seat is one Workspace user who signed in to the extension. Open or allowlist mode, a cap, reclaim after 60 idle days, block, and inviting admins.
- [How does Applane billing work?](https://docs.applane.dev/console/billing.md): €12 per builder per month or €120 per year, a 14-day trial with no card, no minimum, cancel any time. Gemini is billed by Google to your own project.
- [Settings](https://docs.applane.dev/console/settings.md): What each field on the console's Settings page does: OAuth client, LLM, platform ACL, coordination sheet, telemetry, data allowlists and feature toggles.
- [Audit log](https://docs.applane.dev/console/audit-log.md): Applane's own record of admin actions and seat changes, filterable and exportable as CSV. Google's logs stay in your project and Admin console.

## For builders

- [How do I install Applane and sign in?](https://docs.applane.dev/builders/install-and-sign-in.md): Install from the Chrome Web Store or get it force-installed, sign in with your work account, and turn on the Google Apps Script API once.
- [How do I build my first app?](https://docs.applane.dev/builders/first-app.md): Open a sheet, describe the tool in plain words, check the sandbox preview, click Deploy. The app lands in your Drive as an Apps Script web app with a URL.
- [How do I share an Applane app?](https://docs.applane.dev/builders/sharing.md): Who can open an app is its audience, fixed at creation: internal, external or anonymous. Who can edit its source is a Drive permission on the project.
- [What is an advisory?](https://docs.applane.dev/builders/advisories.md): An advisory flags an app that needs a fix because the platform changed after it was built. Severity runs from info to emergency; fixes from re-push up.
- [How do I connect Claude Code or Claude Desktop to Applane?](https://docs.applane.dev/builders/claude-code.md): Register applane-mcp as an MCP server, start Claude, type the six-digit pairing code into the panel. The agent builds with your token, in front of you.

## Security and data

- [What data reaches Applane?](https://docs.applane.dev/security/data-flow.md): Your domain name, a Google ID token used once, and what admins type in the console. Never a Google access token, app source, prompt or row of your data.
- [Which OAuth scopes does the Applane extension request?](https://docs.applane.dev/security/scopes.md): Sign-in, Apps Script projects, deployments and processes, Sheets, Drive read-only and cloud-platform. Granted to your own client; no verification applies.
- [Where is my data stored?](https://docs.applane.dev/security/where-things-are-stored.md): Apps and data stay in your Google. Chat history stays in the browser. Applane holds tenant config, admin and builder emails, seat events and invoices.
- [DPA and sub-processors](https://docs.applane.dev/security/dpa-and-sub-processors.md): Applane is a processor for admin and builder emails, a controller for billing contacts. Sub-processors: Supabase, Cloudflare, Stripe, an EU email provider.
- [What happens when Applane is unreachable?](https://docs.applane.dev/security/licence-and-offline.md): Licences last 72 hours and are accepted 7 more days offline, so builders keep working through a 10-day outage. Deployed apps never depend on Applane.

## Reference

- [applane-setup.sh flags](https://docs.applane.dev/reference/setup-script.md): Every flag of applane-setup.sh: --project, --group, --budget-account, --budget-amount, --extension-id, --dry-run and --check, with what --check prints.
- [Terraform module](https://docs.applane.dev/reference/terraform-module.md): Inputs, outputs and resources of the customer-gcp Terraform module: five APIs, one IAM binding, an optional budget, and why the OAuth client is not in it.
- [Chrome policy JSON](https://docs.applane.dev/reference/chrome-policy.md): The full chrome-policy.json for the Applane extension: force-install, allow-only and the managed storage tenantDomain block, with where each one goes.
- [Applane error messages](https://docs.applane.dev/reference/errors.md): Every error a builder or admin can see, from redirect_uri_mismatch to seat_cap_reached: what it means, who fixes it, and how.
- [Glossary](https://docs.applane.dev/reference/glossary.md): Builder, seat, tenant, audience, advisory and the other words this site uses, with what each one means in Applane.

## Changelog

- [Changelog](https://docs.applane.dev/changelog.md): What changed on the Applane docs site, newest first.