# Does Applane need to be a trusted app in Google Workspace?

> Not for the extension: its OAuth client is yours. Only the admin console's Google sign-in may need trusting if API controls block third-party apps.

Source: https://docs.applane.dev/workspace-admins/third-party-app-access/

**Who:** Google Workspace admin  
**Time:** 2 minutes, usually nothing to do

Google Workspace lets you restrict which OAuth apps can access your users' data (**Security > Access and data control > API controls**). Applane sits on the easy side of that control.

## The extension: your own app, nothing to trust

The OAuth client the extension signs in with belongs to your GCP project. Its consent screen is Internal and carries your own app name. In Google's eyes, an employee granting scopes to it is granting scopes to your company's own app.

So there is no Applane app to add to your trusted list for the extension. If your API controls are set to "restricted" for Google services, apps in your own organisation are still allowed, and this one is in your organisation.

You can see and revoke the grant per user under **Security > API controls > Manage third-party app access**, where it appears under the app name your GCP admin chose (for example `Applane (Acme)`). Revoking it there signs that user out of the extension; they can sign in again unless you also block the app.

## The admin console: Applane's own sign-in

The Applane admin console at `admin.applane.dev` is different. Its "Sign in with Google" uses Applane's own Google client, with the `openid`, `email` and `profile` scopes only. Those scopes are non-sensitive; the client reads the admin's email address and nothing else.

If your API controls block unlisted third-party apps from using Google sign-in, an admin will see `access_denied` or `admin_policy_enforced` on the console's sign-in page. Two ways to fix it:

1. **Security > API controls > Manage third-party app access > Configure new app**. Search for the Applane console by name, or add it by its client id (ask support for it if the search does not find it). Mark it **Trusted** for the OU of the people who will administer Applane. It only needs the basic sign-in scopes.
2. Or set Google sign-in to **Allow users to access any third-party app** for that OU alone.

The first is the narrower change. The extension is not affected either way; it never uses Applane's client.

## The MCP bridge

[Connecting Claude Code or Claude Desktop](https://docs.applane.dev/builders/claude-code/) adds no OAuth client and asks for no extra scopes. The bridge drives the extension's existing token. There is nothing to trust for it.