Connect Google Cloud Platform Account

Connect your GCP account to OEC.sh using secure OAuth authentication.

What You'll Get

After connecting your GCP account, OEC.sh can:

Prerequisites

Before you begin, ensure you have:

• Active GCP project (Create one here (opens in a new tab))
• Billing enabled on your project
• Owner or Editor role on the project
• Required APIs enabled (see Enable APIs)

Enable Required APIs

Before connecting, enable these APIs in your GCP project:

1. Go to GCP Console (opens in a new tab)
2. Select your project
3. Go to APIs & Services > Enable APIs and Services
4. Enable these APIs:

Important: If APIs aren't enabled, you'll get "API not enabled" errors when using OEC.sh features.

Connection Method

GCP uses OAuth 2.0 authentication. You'll authorize OEC.sh to access your GCP resources through Google's secure login.

Step-by-Step Connection

Step 1: Navigate to Cloud Accounts

1. Log in to app.oec.sh (opens in a new tab)
2. Click Settings in the left sidebar
3. Click the Cloud Accounts tab

Step 2: Start Connection

1. Click the Add Account button
2. Under One-Click Connect (OAuth), find Google Cloud
3. Click the Google Cloud card

Step 3: Sign in to Google

A new browser tab opens to Google:

1. Sign in with your Google account
   • Use an account with project Owner or Editor access
2. Select the Google account if prompted

Step 4: Review and Consent

Google shows you what OEC.sh is requesting:

Permissions requested:

• View and manage Compute Engine resources
• View and manage Cloud Storage
• View your GCP projects

Review carefully:

1. Verify the app name shows "OEC.sh"
2. Confirm the permissions list
3. Click Continue (or Allow)

Note: You may see "This app isn't verified" warning. This is normal for new OAuth apps. Click "Advanced" > "Go to OEC.sh (unsafe)" to proceed.

Step 5: Confirm Connection

After authorization:

1. Browser redirects back to OEC.sh
2. Your GCP account appears in the list
3. Status shows Active with a green badge
4. Capability badges display: Compute, Storage, DNS

Verify Your Connection

Check Account Status

Your connected account should display:

• Name: "Google Cloud" (you can rename it)
• Status: Active (green)
• Capabilities: Compute, Storage, DNS badges
• Account: Your Google email

Test the Connection

1. Find your account in the list
2. Click the refresh icon (circular arrow)
3. Status should remain "Active"
4. If validation fails, see Troubleshooting

What Permissions Does OEC.sh Request?

When you authorize OEC.sh, we request these GCP scopes:

We can access:

• Compute Engine instances in your projects
• Cloud Storage buckets and objects
• Cloud DNS zones and records

We never:

• Access Gmail, Drive, or other Google services
• Modify billing settings
• Access resources in projects you don't authorize

GCP Project Requirements

IAM Roles

The Google account used must have these roles on the project:

Or simply:

• roles/owner - Full access (for initial setup)
• roles/editor - Edit access (no IAM management)

Billing

Your project must have billing enabled:

1. Go to Billing in GCP Console
2. Link a billing account to your project
3. Without billing, you cannot create resources

Using Your GCP Account

For Server Provisioning

1. Go to Servers > Add Server
2. Choose Provision from Cloud
3. Select your GCP account
4. Choose:
   • Project (if multiple)
   • Region/Zone (e.g., us-central1-a)
   • Machine Type (e.g., e2-medium)
5. Click Provision

For Backup Storage

1. Go to Settings > Storage
2. Click Quick Setup on your GCP account
3. Select or create a Cloud Storage bucket
4. Configure backup settings

Note: GCP Cloud Storage is S3-compatible via HMAC keys. OEC.sh handles this automatically.

For DNS Management

1. Go to Settings > DNS Providers
2. Click Quick Setup on your GCP account
3. Select a Cloud DNS managed zone
4. OEC.sh will manage A records automatically

Managing Your Connection

Refresh Token

OAuth tokens expire periodically. OEC.sh auto-refreshes them, but if issues occur:

1. Click the refresh icon on your account
2. OEC.sh will attempt token refresh
3. Status should update

Reconnect Account

If refresh fails (e.g., password changed, permissions revoked):

1. Click the Reconnect button
2. Sign in with Google again
3. Re-authorize OEC.sh

Disconnect Account

1. In OEC.sh: Delete the cloud account
2. In Google: Go to Security Settings (opens in a new tab)
3. Find and revoke OEC.sh access

Troubleshooting

"This app isn't verified" Warning

Cause: New OAuth apps go through Google's verification process.

Solution:

1. Click Advanced (bottom left)
2. Click Go to OEC.sh (unsafe)
3. Continue with authorization

This is safe - it just means the app is in verification.

"API not enabled" Error

Cause: Required GCP APIs aren't enabled.

Solution:

1. Go to GCP Console > APIs & Services
2. Enable the missing API (see Enable APIs)
3. Wait 1-2 minutes for propagation
4. Try again in OEC.sh

"Authorization Denied" Error

Cause: You clicked "Deny" or closed the window.

Solution:

1. Click Add Account again
2. Complete the authorization flow
3. Click Allow when prompted

Account Shows "Expired"

Cause: OAuth tokens expired and couldn't auto-refresh.

Possible reasons:

• Google account password changed
• Two-factor authentication reset
• Revoked access in Google Security settings

Solution:

1. Click Reconnect on the account
2. Sign in with Google
3. Re-authorize OEC.sh

"No projects found" Error

Cause: No projects accessible to your account.

Solution:

1. Create a GCP project if you don't have one
2. Verify you have Owner/Editor role on at least one project
3. Ensure billing is enabled on the project

VM Creation Fails

Cause: Could be quota limits, API issues, or permissions.

Solutions:

1. Quotas: Check IAM & Admin > Quotas
2. APIs: Ensure Compute Engine API is enabled
3. Billing: Verify billing is active
4. Region: Try a different zone/region

Storage Bucket Access Denied

Cause: Bucket permissions or organization policies.

Solution:

1. Check bucket IAM permissions
2. Verify organization policies allow the access
3. Ensure storage API is enabled

GCP Regions and Zones

OEC.sh supports major GCP regions:

Tip: Choose a zone close to your users for best performance.

Cost Considerations

GCP charges for resources created by OEC.sh:

Tips to minimize costs:

• Use preemptible VMs for non-production
• Enable committed use discounts
• Set up Cloud Storage lifecycle rules
• Use e2- machine types (cost-optimized)

Alternative: Service Account (API Key)

For automated pipelines or if OAuth doesn't work, you can use a service account:

1. Go to GCP Console > IAM & Admin > Service Accounts
2. Create a service account
3. Grant required roles
4. Create and download JSON key
5. In OEC.sh, use API Key Authentication > Google Cloud
6. Paste the JSON key contents

Note: OAuth is preferred as it doesn't require managing key files.

Next Steps

• Provision your first GCP VM
• Configure Cloud Storage for backups
• Set up Cloud DNS