Reference
How Parent Connector integrates with Google Classroom
A technical overview for school IT administrators and reviewers: what Parent Connector requests, what it reads, what it stores, and how a district approves it.
Summary
- Parent Connector is a web app (Next.js, hosted on Vercel, with a Supabase Postgres database).
- It uses the Google Classroom API v1 through OAuth 2.0 (web-server flow, offline access).
- Every Classroom scope it requests is read-only. It never creates, modifies, submits, or deletes anything in Classroom.
- It only reads data the authorizing student can already see about themselves: their courses, coursework, and their own submissions.
Authorization flow
- A parent signs in to their Parent Connector account (email and password, separate from Google).
- The parent chooses “Connect a child.” Parent Connector redirects to Google's OAuth consent screen with the scopes listed below.
- The student signs in with their school Google account and approves access on Google's screen.
- Google redirects back with an authorization code. The server exchanges it for an access token and a refresh token, then reads the student's email and name from Google's OpenID Connect userinfo endpoint.
- The tokens are stored server-side, tied to the parent's account. The browser never receives them.
OAuth scopes requested
| Scope | Why |
|---|---|
openid | Standard sign-in. Identifies which Google account was connected. |
https://www.googleapis.com/auth/userinfo.email | The student's school email, so the parent can see which account is connected. |
https://www.googleapis.com/auth/userinfo.profile | The student's display name, shown to the parent. |
https://www.googleapis.com/auth/classroom.courses.readonly | List the student's active courses. |
https://www.googleapis.com/auth/classroom.coursework.me.readonly | Read published coursework in those courses and the student's own submissions. |
https://www.googleapis.com/auth/classroom.student-submissions.me.readonly | Read the student's own submission state and any score the teacher returned. |
https://www.googleapis.com/auth/classroom.announcements.readonly | Show the latest class announcement on a class page. |
https://www.googleapis.com/auth/classroom.rosters.readonly | Show the teacher's name on a class page (courses.teachers.list). |
https://www.googleapis.com/auth/classroom.courseworkmaterials.readonly | Requested but not currently used by any feature. |
https://www.googleapis.com/auth/classroom.topics.readonly | Requested but not currently used by any feature. |
Classroom API calls
All calls are GET requests against https://classroom.googleapis.com, made from the server with the student's access token.
| Call | Used for |
|---|---|
GET /v1/courses?studentId=me&courseStates=ACTIVE | The student's active classes |
GET /v1/courses/{courseId}/courseWork?courseWorkStates=PUBLISHED | Assignments in each class |
GET /v1/courses/{courseId}/courseWork/-/studentSubmissions?userId=me | The student's own submission status for each assignment |
GET /v1/courses/{courseId} · /courseWork/{id} · /studentSubmissions?userId=me | A single assignment's detail page |
GET /v1/courses/{courseId}/teachers | Teacher name on the class page |
GET /v1/courses/{courseId}/announcements?announcementStates=PUBLISHED | Latest announcement on the class page |
What is stored, and what isn't
Stored (per connected student)
- The parent's account ID it belongs to
- The student's Google account email and display name
- The Google OAuth access token, refresh token, expiry time, and connection status
Not stored
- Classroom content — courses, assignments, submissions, scores, announcements, and teacher names are fetched live from the Classroom API each time a page is viewed and aren't written to our database.
- Student files, private comments, or messages — these aren't requested at all.
Database access is protected by row-level security, so a parent can only read the connections that belong to their own account.
Disconnecting
A parent can disconnect a student at any time from Settings, which deletes that student's stored record and tokens. The student or their school can also revoke access at any time from the Google Account “Third-party apps & services” page or the Google Admin console.
District allowlisting
Google Workspace for Education requires admins to approve third-party apps before users under 18 can authorize them. To let families in a district use Parent Connector, an admin:
- Opens the Google Admin console → Security → Access and data control → API controls → Manage Third-Party App Access.
- Adds Parent Connector by its OAuth client ID (we provide it on request).
- Sets it to Trusted or Limited for the relevant student organizational units.
Districts interested in a pilot can reach us at hello@edstitch.com.
Why we're requesting a Google Workspace for Education demo domain
Parent Connector is currently tested against a single test Classroom account. A demo domain would let us build and test against realistic Classroom data — many courses, multiple teachers, and assignments in every state (missing, late, turned in, returned with a score) — and to test the admin allowlisting flow end to end, all without touching any real student's data.
Related
- Parent Connector product overview
- Privacy policy (including our Google API Services User Data Policy disclosure)
- Terms of service