Does Applane need to be a trusted app in Google Workspace?

Who

Google Workspace admin

Time

2 minutes, usually nothing to do

Google Workspace lets you restrict which OAuth apps can access your users’ data (Security > Access and data control > API controls). Check the builder and admin console separately: they use different OAuth clients.

Check your internal builder client

The OAuth client the builder signs in with belongs to your GCP project. Its consent screen is Internal and carries your own app name. In Google’s eyes, an employee granting scopes to it is granting scopes to your company’s own app.

So there is no Applane app to add to your trusted list for the builder. If your API controls are set to “restricted” for Google services, apps in your own organisation are still allowed, and this one is in your organisation.

You can see and revoke the grant per user under Security > API controls > Manage third-party app access, where it appears under the app name your GCP admin chose (for example Applane (Acme)). Revoking it there signs that user out of the builder; they can sign in again unless you also block the app.

The admin console: Applane’s own sign-in

The Applane admin console at admin.applane.dev is different. Its “Sign in with Google” uses Applane’s own Google client, with the openid, email and profile scopes only. Those scopes are non-sensitive; the client reads the admin’s email address and nothing else.

If your API controls block unlisted third-party apps from using Google sign-in, an admin will see access_denied or admin_policy_enforced on the console’s sign-in page. Two ways to fix it:

1. Security > API controls > Manage third-party app access > Configure new app. Search for the Applane console by name, or add it by its client id (ask support for it if the search does not find it). Mark it Trusted for the OU of the people who will administer Applane. It only needs the basic sign-in scopes.
2. Or set Google sign-in to Allow users to access any third-party app for that OU alone.

The first is the narrower change. The builder is not affected either way; it never uses Applane’s client.

The MCP bridge

Connecting Claude Code or Claude Desktop adds no OAuth client and asks for no extra scopes. The bridge drives the builder’s existing token. There is nothing to trust for it.