To make itopia Labs as easy as possible to setup and administer, we ask the K12 School District to grant Labs secure, programmatic, domain-wise access to it's user's data via Google Workspace Domains.
In Google Workspace Domains, the domain administrator can grant third-party applications with domain-wide access to its users' data — this is referred as domain-wide delegation of authority. If you really want to know the details -- to delegate authority this way, domain administrators can use service accounts with OAuth 2.0.
Let's walk thru the the steps to grant Domain-Wide Delegation.
Grant Domain-Wide Delegation Setup
To begin, login to your Google Workspace Admin Console as a Super Administrator. Navigate to Security 🡪 API Controls. Link:
In the Domain wide delegation section, Click Manage Domain Wide Delegation.
Click Add new
In the configuration pane, specify the following:
Client ID: 102628712181650693336
OAuth Scopes: https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.member.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/classroom.courses.readonly, https://www.googleapis.com/auth/classroom.rosters.readonly, https://www.googleapis.com/auth/classroom.profile.emails
Google Admin portal view Security --> API Controls
View from the Google Cloud Admin Portal to help locate this feature:
Add a new Client ID and OAuth Scopes and select Authorize.