# Applane error messages

> Every error a builder or admin can see, from redirect_uri_mismatch to seat_cap_reached: what it means, who fixes it, and how.

Source: https://docs.applane.dev/reference/errors/

## From Google's sign-in page

| Error | What it means | Who fixes it | How |
|---|---|---|---|
| `redirect_uri_mismatch` | The OAuth client is missing one of the two redirect URIs, or one differs: trailing slash, `http`, a typo in the extension id. | GCP admin | Paste both URIs exactly as the Applane console shows them. Google takes up to a minute to apply the change. [OAuth client](https://docs.applane.dev/gcp-admins/oauth-client/) |
| `invalid_client` | The client id saved in the Applane console is wrong, or the client was deleted. | GCP admin, Applane admin | Copy the Client ID again from **Credentials**, check for a trailing space, save it in the console. If the client was deleted, create a new one. |
| `access_denied` | The consent screen is not Internal, or the account is outside your organisation, or a Workspace admin blocked the app. | GCP admin; then the user; then the Workspace admin | Set the user type to Internal. Sign in with a work account. Check **Security > API controls > App access control**. [OAuth consent screen](https://docs.applane.dev/gcp-admins/oauth-consent-screen/) |
| `admin_policy_enforced` | Workspace restricts third-party apps to a trusted list and this app is not on it. | Workspace admin | For the extension this should not happen because the client is yours; check the client belongs to a project in your organisation. For the admin console, trust it: [Third-party app access](https://docs.applane.dev/workspace-admins/third-party-app-access/). |
| `org_internal` | A personal or external Google account tried to sign in to an Internal app. | The user | Expected. Use a work account. |

## From the Apps Script API

### Apps Script 403

| What it means | Who fixes it | How |
|---|---|---|
| The builder's personal **Google Apps Script API** setting is off. Every Apps Script API call for that user returns HTTP 403 until it is on. | The builder | Open [script.google.com/home/usersettings](https://script.google.com/home/usersettings), turn it on, return to the panel. The panel shows this as a card and re-checks on its own. [Apps Script API](https://docs.applane.dev/workspace-admins/apps-script-api/) |

If the setting is on and 403 persists, check that `script.googleapis.com` is enabled on the project ([The five APIs](https://docs.applane.dev/gcp-admins/apis/)) and that **Apps > Google Workspace > Apps Script** is on for the builder's organisational unit.

## From Applane

These come back when the extension asks Applane for the company record or a licence.

### `unknown_domain`

| What it means | Who fixes it | How |
|---|---|---|
| No verified company matches the sign-in domain. Either nobody signed up, the TXT record is not in place yet, or the domain is an alias that was not added. | Applane admin, DNS owner | Add and verify the TXT record. If it was just added, wait for DNS and try again. [Verify your domain](https://docs.applane.dev/console/verify-domain/) |

### `seat_cap_reached`

| What it means | Who fixes it | How |
|---|---|---|
| Every seat is active. The message names the admins to ask. Existing builders keep working. | Applane admin | Raise the cap, or reclaim an idle seat, under **People**. On trial the cap is 10; subscribe to raise it. [People and seats](https://docs.applane.dev/console/people-and-seats/) |

### `not_allowlisted`

| What it means | Who fixes it | How |
|---|---|---|
| The company uses allowlist seat mode and this address is not on the list. | Applane admin | Add the address under **People > Allowlist**, or switch to open mode. |

### `extension_too_old`

| What it means | Who fixes it | How |
|---|---|---|
| The installed version is below the minimum Applane accepts. The message carries the minimum version. | The builder, or the Workspace admin | Update at `chrome://extensions` (**Update** in developer mode), or wait for the managed update; force-installed extensions update on their own within hours. |

### `billing_required`

| What it means | Who fixes it | How |
|---|---|---|
| The trial ended without a subscription, or the subscription lapsed. New sign-ins are refused; existing builders lock after the 7-day grace. | Owner | Subscribe or fix the card under **Billing**. Seats pick up within 12 hours or at the next sign-in. [Billing](https://docs.applane.dev/console/billing/) |

### `tenant_suspended`

| What it means | Who fixes it | How |
|---|---|---|
| The company is suspended: 30 days past due, or on request. | Owner | Update the card in the billing portal, or write to support. |

### `domain_not_verified`

| What it means | Who fixes it | How |
|---|---|---|
| The company exists but the domain check has not passed. Seen in the console, not the extension. | Applane admin | Click **Verify** once the TXT record is live. |

### `rate_limited`

| What it means | Who fixes it | How |
|---|---|---|
| Too many requests from one address in a short time. | Nobody | Wait a minute. |

## In the Applane console

| Message | What it means | How |
|---|---|---|
| "`acme.com` already has an Applane account." | Someone at your company signed up first. | Ask them to invite you from **People**, or write to support. |
| "Google did not return to the console." | The test sign-in popup hit a Google error. | Read the error in the popup; it is one of the sign-in errors above. |
| "The browser blocked the popup." | Popups are blocked for `admin.applane.dev`. | Allow them and try again. |
| "Trial allows up to 10 seats." | The cap field is above the trial limit. | Subscribe to raise it. |
| "Missing: `aiplatform.googleapis.com`." | One of the five APIs is off. | Run the [script](https://docs.applane.dev/gcp-admins/setup/script/) or enable it by hand. |