Slot

diff --git a/README.md b/README.md
index 0612f0f..94d80ee 100644
--- a/README.md
+++ b/README.md
@@ -44,6 +44,67 @@ Requirements:
 - a Google Cloud project with **Google Calendar API enabled**
 - a Google OAuth **Web application** client
 
+## Google Cloud setup
+
+Google has two separate setup areas that both matter:
+
+1. Enable the **Google Calendar API** for the project.
+2. Create an **OAuth client ID and client secret** for this app.
+
+Doing only one of these is not enough. If OAuth exists but the Calendar API is not enabled, Slot can sign in but Google Calendar calls will fail with a Calendar API / FreeBusy error.
+
+### 1. Enable Google Calendar API
+
+1. Open [Google Cloud Console](https://console.cloud.google.com/).
+2. Select or create the project you want to use for Slot.
+3. Go to **APIs & Services** -> **Library**.
+4. Search for **Google Calendar API**.
+5. Open **Google Calendar API** and click **Enable**.
+
+This is separate from OAuth credentials. The OAuth client controls sign-in; the enabled Calendar API controls whether the app may call FreeBusy and create events.
+
+### 2. Configure OAuth consent
+
+1. In the same Google Cloud project, go to **APIs & Services** -> **OAuth consent screen**.
+2. Choose the audience that fits your use:
+   - **Internal** if this is only for your Google Workspace organization.
+   - **External** if you use a normal Gmail account or need access outside one Workspace organization.
+3. Fill in the app name, support email, and developer contact email.
+4. If the app is in **External / Testing**, add the same Google account you will use as Slot admin under test users.
+
+Slot requests Calendar access only for the configured admin account. Visitors never log in with Google.
+
+### 3. Create OAuth client ID and secret
+
+1. In Google Cloud, go to **APIs & Services** -> **Credentials**.
+2. Click **Create credentials** -> **OAuth client ID**.
+3. Choose **Web application**.
+4. Give it a name, for example `Slot`.
+5. Add the public origin for your deployed Slot URL:
+
+```text
+Authorized JavaScript origin:
+https://book.example.com
+```
+
+6. Add the callback URL for the same deployed Slot URL:
+
+```text
+Authorized redirect URI:
+https://book.example.com/auth/google/callback
+```
+
+7. Click **Create**.
+8. Copy the generated **Client ID** and **Client secret**.
+9. Use those two values when `npm run setup` asks for:
+
+```text
+Google OAuth Client ID
+Google OAuth Client Secret
+```
+
+If you change the public domain later, update the OAuth client redirect URI to match the new domain exactly.
+
 Install:
 
 ```bash