School setup

Only a Google Workspace admin can let students sign in to an outside app. In a public school board, that’s board IT. When board IT configures SideKrew School for a pilot organizational unit (OU), after the board’s own approval process, that is the board saying yes. A principal or a teacher can’t give that yes for the board.

At an independent school with its own Google Workspace, the school’s own admin does this once the head of school has signed the pilot agreement.

• The pilot agreement is signed by the head of school and the school’s Google Workspace admin.
• Create a pilot OU that holds only students whose parent or guardian returned the signed pilot consent form. Add nobody else.
• Have SideKrew School’s OAuth client ID ready (next section).

SideKrew School asks for these scopes and nothing else. The first three are for signing in; the other four are read-only Classroom scopes.

• openid
• email
• profile
• https://www.googleapis.com/auth/classroom.courses.readonly
• https://www.googleapis.com/auth/classroom.coursework.me.readonly
• https://www.googleapis.com/auth/classroom.announcements.readonly
• https://www.googleapis.com/auth/classroom.courseworkmaterials.readonly

1. In the Google Admin console, go to Menu › Security › Access and data control › API controls. You need the Service Settings admin privilege.
2. Click Manage App Access. Under Configured apps, click Configure new app.
3. Enter the OAuth client ID above, click Search, then click SideKrew School in the results.
4. For Scope, click Select org units, then Include organizations. Check your pilot OU only, and click Select. Click Continue.
5. Under Access to Google data, choose Specific Google data. Include the sign-in scopes and the four read-only Classroom scopes above, and nothing else. Click Continue.
6. Review the settings and click Finish.

Turning on only “Allow users to access third-party apps that only request basic info needed for Sign in with Google” isn’t enough. Students could sign in, but Classroom would stay blocked. Configure the app as above.

Parental consent: Google’s help says “For users under the age of 18, your organization is responsible for obtaining parental consent, if required by applicable law.” If Google shows a Confirm parental consent notice, read it and click Confirm. The pilot consent form each parent signs and returns to the school is that consent; only students whose form came back belong in the pilot OU.

1. In the Admin console, go to Apps › Google Workspace › Classroom (Google Workspace for Education and Nonprofits) or Apps › Additional Google services › Classroom (Workspace Basic, Business and Education Plus).
2. Select your pilot OU.
3. Click Data access. Next to Classroom API, check the box, then save.

This lets students in the pilot OU give SideKrew School read-only access to their own Classroom data.

Google says changes can take up to 24 hours, but often take effect sooner. After that, students in your pilot OU can connect from the start link that unlocks once their parent says yes.

Use a test student account in your pilot OU that has never connected to SideKrew School. Never use a pilot student’s account: handing permissions back to Google would disconnect that student. If you pick a connected account, the test stops and changes nothing. The test asks Google two things: can this account sign in to SideKrew School, and can it give read-only Classroom access? Then it hands every permission straight back.

• Nothing is saved: no account, no sign-in, no record of who took the test.
• No Classroom data is read. We only check whether Google answers.
• If Google shows “Access blocked”, Step 1 isn’t done yet for that account. Come back here and check the pilot OU.

• Write to Classroom: no posting, turning in, changing, grading or messaging.
• Store or show grades.
• Ask for Google Drive or Gmail.
• Read anything for a student outside your pilot OU or off the school’s roster.
• Scrape Classroom pages, or use anyone else’s sign-in.
• Turn on AI help in a class whose teacher didn’t say yes in writing.
• Sell data, show ads, or let anyone use student data to train AI models.

Write to privacy@sidekrew.com. What we do with the data is in the privacy notice and How we use Google data.