# Which OAuth scopes does the Applane extension request?

> Sign-in, Apps Script projects, deployments and processes, Sheets, Drive read-only and cloud-platform. Granted to your own client; no verification applies.

Source: https://docs.applane.dev/security/scopes/

The extension requests these scopes at sign-in. They are granted to your own OAuth client, never to an Applane client. Because the consent screen is Internal, no scope needs Google verification and no CASA assessment applies. See [No Google app verification needed](https://docs.applane.dev/gcp-admins/no-verification-needed/).

Google's classification is shown so a reviewer can map it to policy.

| Scope | Google's class | What the extension does with it |
|---|---|---|
| `openid`, `email` | Non-sensitive | Sign the employee in and check that the account is a verified member of your Workspace domain. Any other account is rejected and its token revoked. |
| `https://www.googleapis.com/auth/script.projects` | Sensitive | Create the Apps Script project for each app and push its files. The project is a Drive file owned by the builder. |
| `https://www.googleapis.com/auth/script.deployments` | Sensitive | Create and update the web-app deployment that gives each app its URL, and repoint it for publish and kill-switch actions. |
| `https://www.googleapis.com/auth/script.processes` | Sensitive | Read-only execution history, so the extension can tell a builder that a scheduled run failed. |
| `https://www.googleapis.com/auth/spreadsheets` | Sensitive | Read sheet schemas while building, and let apps on the read-write tier write to sheets as the signed-in viewer. |
| `https://www.googleapis.com/auth/drive.readonly` | Restricted | List the apps shared with the builder and read the docs, slides and folders they point the agent at. Never writes. |
| `https://www.googleapis.com/auth/cloud-platform` | Sensitive | Call Vertex AI (Gemini) in your GCP project with the builder's own identity, so usage is attributed and billed to you. |

## About `cloud-platform`

It is the broadest GCP scope, and reviewers ask about it. Three things bound it:

1. A token is only as powerful as its user's IAM. A typical employee holds no GCP role beyond the `roles/aiplatform.user` grant Applane's setup adds, so the scope unlocks Vertex calls and nothing else for them.
2. The client is Internal and the token never leaves Chrome's identity plumbing; it is not sent to Applane.
3. Generated app code runs in a sandbox that cannot reach the token.

Engineers who do hold real GCP roles should know the extension could act with them; the sandbox is the mitigation.

## Scopes are fixed per build

The list is decided by the extension build, not per company. Turning the external or anonymous audiences off in [Settings](https://docs.applane.dev/console/settings/) hides those features; it does not change the consent screen.

## Revoking

A Workspace admin sees the grant per user under **Security > API controls > Manage third-party app access**, under your app's name, and can revoke it there. A user can do the same at [myaccount.google.com/permissions](https://myaccount.google.com/permissions). Either signs them out of the extension.