For Schools › IT admin setup guide

IT admin setup guide

How to let students sign in to thelabgames.org with their school Google accounts.

The app

App name	The Lab Games
Website	https://thelabgames.org
OAuth Client ID	`760487283600-nq4r5d2plb2a3dtpars01g9v79ftluu0.apps.googleusercontent.com`
Scopes requested	`openid`, `email`, `profile` only (basic Google sign-in)
Sign-in method	Google Identity Services “Sign in with Google.” The ID token is verified on the server (signature, audience, issuer, expiry).

What the app can and can't access

Can: the Google account ID, email address, name and profile picture link that Google includes in a basic sign-in, used only to sign the person in and to show teachers who their students are.
Can't: Google Drive, Gmail, Google Classroom, Calendar, contacts, or anything else in the account. The app requests no other scopes and has no access tokens for Google APIs.

Option A (recommended): mark the app as Trusted

Sign in to the Google Admin console (admin.google.com) as an administrator.
Go to Security → Access and data control → API controls.
Select Manage Third-Party App Access.
Select Add app → OAuth App Name or Client ID.
Search for the Client ID above: 760487283600-nq4r5d2plb2a3dtpars01g9v79ftluu0.apps.googleusercontent.com, and select The Lab Games.
Choose the organizational units for your students (and teachers), then set access to Trusted.
Save. It can take a little while to take effect.

Option B: allow basic sign-in for unconfigured apps

Instead of trusting this app individually, you can let users under 18 sign in to unconfigured third-party apps that request only basic Google sign-in information (name, email, profile picture). In API controls → Settings, under the unconfigured third-party apps setting for users under 18, choose the option that allows apps requesting only basic sign-in information. The exact wording of this setting can change. Look for the option that allows apps requesting only basic sign-in information. This applies to every such app, not just The Lab Games.

Domains to allow in web filters

thelabgames.org: the site and its API (thelabgames.org/api/)
accounts.google.com: Google sign-in

The browser never contacts any other domain for accounts. The database (Cloudflare) is reached only by the site's server, not by students' browsers.

Without Google

Students can always use every sim and game signed out. If their teacher adds them to a class, they can also sign in with the class code and their student ID, with no Google account involved.