Allowing GradeInClass at your school

1. Allow the web address

GradeInClass is a website. Teachers use it in a browser on a phone, tablet, or laptop. Students never sign in and never need a device.

gradeinclass.com

www.gradeinclass.com redirects there, so allowing both is safest. HTTPS, port 443. The site, the teacher app, grade backup, and live updates between a teacher's own devices are all served from that one domain — there is no separate app or API hostname to allow.

Live updates use a WebSocket (wss://gradeinclass.com/realtime/…) on that same host. If your proxy blocks WebSocket upgrades, nothing breaks: the app falls back to checking for changes once a minute over ordinary HTTPS.

Google's own hosts, for sign-in

Teachers sign in with Google, so the browser also contacts Google. Most schools already allow these for Workspace itself:

• accounts.google.com — the Sign in with Google button and the sign-in window.
• lh3.googleusercontent.com — the teacher's own Google profile photo, shown on their account screen.
• fonts.gstatic.com — the font used by Google's sign-in button.

Only if a teacher connects Google Classroom

Google Classroom import is optional, and these hosts are contacted only after a teacher turns it on:

• classroom.googleapis.com — the Classroom API: that teacher's courses, rosters, assignments, and grades.
• openidconnect.googleapis.com — reads back which Google account was just connected, so the app can show it.
• www.googleapis.com — Google's API front door.

If your filter already allows Google's own domains as a group — *.google.com, *.googleapis.com, *.gstatic.com, *.googleusercontent.com — none of the Google hosts above need a separate entry, and gradeinclass.com is the only one left to add.

Category, if your filter asks for one

Education / Educational institutions / Educational tools.

Why it may be blocked today

gradeinclass.com was registered on July 11, 2026. Filters that block newly registered or uncategorized sites catch it because no filter vendor has assigned it a category yet, not because it was flagged. An allow-list entry takes effect immediately; a recategorisation request to your filter vendor is the durable fix, and we're glad to file one if you tell us which filter you run.

• Palo Alto Networks — urlfiltering.paloaltonetworks.com ("Request URL Category Change")
• Fortinet FortiGuard — web filter lookup, rating submission
• Cisco Umbrella / Talos — talosintelligence.com/reputation_center/web_categorization
• Symantec / Broadcom — sitereview.symantec.com
• Zscaler — sitereview.zscaler.com
• Lightspeed, GoGuardian, Securly, iboss — category feedback and allow rules live in your admin console (Lightspeed Filter Admin Portal → Access Checker; GoGuardian Admin → Website categories → Suggest Category; Securly → Category Lookup → Request category change; iboss → allow list).

2. Approve the Google sign-in (Google Workspace for Education)

Teachers sign in with their school Google account. If your Workspace restricts third-party apps — the default for many Education tenants — the teacher sees "Access blocked: Your institution's administrator needs to review GradeInClass" and sign-in stops there until the app is configured.

1. Open the Google Admin console: admin.google.com
2. Go to Security → Access and data control → API controls, then Manage Third-Party App Access (direct link).
3. Configured apps → Add app → OAuth App Name Or Client ID, paste the client ID below, select the web app, and choose Trusted (everything) or Limited (sign-in works; Classroom features stay off).
4. If a teacher already pressed Google's "Request access" button, the request is waiting under API controls → App access control → Apps pending review (Allow / Dismiss / Block).

Google's own instructions: Control which third-party & internal apps access Google Workspace data

App name:        GradeInClass
App type:        Web application
OAuth client ID: 751132360793-rramfn41egne16lpcuvpbgaq64dbd8td.apps.googleusercontent.com
Developer:       David Ludlow · contact@gradeinclass.com

Requested to sign in — identity only

• openid — sign the teacher in
• email — their address, which is their account name
• profile — their name and photo, shown on their own account screen

Requested only if the teacher chooses to connect Google Classroom (a separate consent; the app is fully usable without it)

To import a class roster:

• https://www.googleapis.com/auth/classroom.courses.readonly — list that teacher's own courses
• https://www.googleapis.com/auth/classroom.rosters.readonly — the students in those courses
• https://www.googleapis.com/auth/classroom.profile.emails — those students' email addresses, used only to match a Classroom student to a roster entry

To send grades back to Classroom:

• https://www.googleapis.com/auth/classroom.coursework.students — read the course's assignments and write back the grades the teacher records

Connecting Classroom asks for the three identity scopes again alongside these four, on one consent screen.

Every scope is limited to courses the signing-in teacher already teaches. GradeInClass never reads Drive, Gmail, or anything outside Classroom. A teacher can use GradeInClass fully without the Classroom scopes — they paste a roster and export a CSV instead.

What GradeInClass stores

For each signed-in teacher: their name, email address, and Google account id; the classes they create; the students they add — first and last name, plus a student ID number or school email address only if the teacher includes one; which students are in which class; and every grade change, as an append-only log — each change is kept with its time and the device that made it, and nothing is overwritten. Student photos, if a teacher adds any, stay on that teacher's device and are never uploaded. There are no student accounts, no student devices, no advertising, no tracking, and no sale of data. Full detail, including where data is stored and every subprocessor: privacy policy · terms of use.

Copy this for a ticket

Everything above, in one block you can paste into a change request.

GradeInClass — request to allow (2 items)

1) WEB FILTER / FIREWALL — allow HTTPS (port 443):
     gradeinclass.com
     www.gradeinclass.com          (301 redirect to the above)
   Category, if one is required: Education / Educational tools
   WebSocket upgrades on wss://gradeinclass.com/realtime/ are used for live
   updates; if blocked, the app falls back to HTTPS polling.

   Google's own hosts, contacted during sign-in:
     accounts.google.com
     lh3.googleusercontent.com     (teacher's Google profile photo)
     fonts.gstatic.com             (font for Google's sign-in button)
   Contacted only if a teacher connects Google Classroom:
     classroom.googleapis.com
     openidconnect.googleapis.com
     www.googleapis.com

2) GOOGLE WORKSPACE — Admin console > Security > Access and data control >
   API controls > Manage Third-Party App Access > Configured apps >
   Add app > OAuth App Name Or Client ID
     App name:        GradeInClass
     App type:        Web application
     OAuth client ID: 751132360793-rramfn41egne16lpcuvpbgaq64dbd8td.apps.googleusercontent.com
     Access:          Trusted (or Limited — sign-in works, Classroom stays off)

   Scopes requested to sign in:
     openid
     email
     profile
   Scopes requested only if the teacher connects Google Classroom:
     https://www.googleapis.com/auth/classroom.courses.readonly
     https://www.googleapis.com/auth/classroom.rosters.readonly
     https://www.googleapis.com/auth/classroom.profile.emails
     https://www.googleapis.com/auth/classroom.coursework.students

Vendor:  GradeInClass — David Ludlow — contact@gradeinclass.com
Details: https://gradeinclass.com/it

Trying it without approving anything

The demo at gradeinclass.com/demo runs on a made-up sample class and needs no account and no Google approval.

Talk to a person

contact@gradeinclass.com — GradeInClass is built by a former high-school physics teacher; you'll get a reply from the person who wrote it. Happy to talk to a district directly, fill out a security questionnaire, or sign a data-privacy agreement.