Connect Google Classroom
Use this guide when your organization uses Self-hosted LDAP or Microsoft 365 for its directory and wants to connect Google Classroom separately.
If your directory provider is Google Workspace, Classroom is included with your existing Google Workspace setup. Complete that setup instead; no separate Classroom credentials are needed.
Before you start
- Configure your LDAP or Microsoft 365 directory provider in Organization → Keys first. It continues to manage your directory accounts after Classroom is connected.
- Have a Google Workspace super administrator available to authorize the connection.
- Every teacher and student who will use Classroom must already have an active Google Workspace account. Its email must match that person's school email in BassemLabs. Connecting Classroom does not create these Google accounts.
- Keep student directory accounts and LMS use enabled for the organization.
1. Create the service account and JSON key
- Open Google Cloud Console and select or create a project for this integration.
- Under APIs & Services → Library, enable Google Classroom API for that project.
- Open IAM & Admin → Service Accounts → Create service account. Give it a name such as
bassem-classroom, then finish creating it. No Google Cloud project role is required for this Classroom connection. - Open the service account and copy its email, such as
[email protected]. - Open Keys → Add key → Create new key, select JSON, and download the file. Keep it private; you will upload it in BassemLabs.
- In the service account's details, open Advanced settings and copy the numeric Client ID under Domain-wide delegation.
See Google's service account instructions if the console labels differ.
2. Authorize only the Classroom permissions
A Google Workspace super administrator must authorize domain-wide delegation in Google Admin Console:
- Open Security → Access and data control → API controls → Manage Domain Wide Delegation.
- Click Add new and enter the service account's numeric Client ID.
- Paste this comma-separated list into OAuth scopes:
https://www.googleapis.com/auth/classroom.courses,https://www.googleapis.com/auth/classroom.rosters,https://www.googleapis.com/auth/classroom.coursework.students
- Click Authorize.
These permissions let BassemLabs manage classes and rosters, create and read coursework, and read student submissions and grades. This separate Classroom connection does not require Admin SDK, Directory, or Google Calendar permissions.
See Google's domain-wide delegation guide and Classroom scope descriptions.
3. Save the credentials in BassemLabs
Open Organization → Keys → LMS Integrations → Google Classroom → Configure. Save the fields in this order:
| Field | Value |
|---|---|
| Google Admin Email | The active Google Workspace administrator account BassemLabs should act as, for example [email protected]. Use a person/account email from your Workspace domain, not the service account email. |
| Google Admin Service Account ID | The service account email copied in step 1, ending in iam.gserviceaccount.com. This field does not take the numeric Client ID used in Google Admin Console. |
| Google Admin Service Account Key | Choose Upload JSON File, select the downloaded service account file, then click Save. This field appears after the service account ID is saved. |
Click Save for each field. Use an admin email, service account email, and JSON file from the same authorized setup.
Check the result
The Classroom card shows Configured when all three credentials are active. Your directory provider still shows Self-hosted LDAP or Microsoft 365. Google Classroom is then available when configuring an LMS for a class.
If setup is incomplete
- Setup incomplete: finish saving the remaining credentials. Already saved fields stay configured.
- The JSON key cannot be saved: check that Classroom API is enabled in the key's project, the numeric Client ID is authorized in Google Admin Console, and all three scopes above are present. Confirm the admin email is an active account in that Workspace domain, then retry the JSON upload. Delegation changes can take time to apply.
- A teacher or student cannot be added: confirm their school email matches an active Google Workspace account and Classroom is enabled for them.
If Google shows an additional administrator approval requirement for domain-wide delegation, complete that approval before retrying. Google's credential setup guide explains delegation propagation.