To make itopia Labs as easy as possible to setup and administer, we ask the K12 School District to grant Labs secure, programmatic, domain-wise access to it's user's data via Google Workspace Domains.

In Google Workspace Domains, the domain administrator can grant third-party applications with domain-wide access to its users' data — this is referred as domain-wide delegation of authority. If you really want to know the details -- to delegate authority this way, domain administrators can use service accounts with OAuth 2.0.

Let's walk thru the the steps to grant Domain-Wide Delegation.

Grant Domain-Wide Delegation Setup

  1. To begin, login to your Google Workspace Admin Console as a Super Administrator. Navigate to Security 🡪 API Controls. Link:

  2. In the Domain wide delegation section, Click Manage Domain Wide Delegation.

  3. Click Add new

  4. In the configuration pane, specify the following:

Client ID: 102628712181650693336

OAuth Scopes: https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.member.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/classroom.courses.readonly, https://www.googleapis.com/auth/classroom.rosters.readonly, https://www.googleapis.com/auth/classroom.profile.emails

  1. Click Authorize.

Google Admin portal view Security --> API Controls

View from the Google Cloud Admin Portal to help locate this feature:

Add a new Client ID and OAuth Scopes and select Authorize.

Did this answer your question?