If your school district uses Google Workspace for Education for its student email addresses, in order for under 18 year old students to access Khan Academy via Google SSO, Khan Academy needs to be configured with an access policy by your Google Workspace for Education administrator.
If your students are seeing one of the below error codes when trying to use Khan Academy's Google SSO login, it is due to the access policy:
Error 400: access_not_configured
- received when an OAuth connection is rejected because the app has not been configured.
Error 400: admin_policy_enforced
- received when an OAuth connection is rejected because the administrator has blocked the application.
This article from Google’s Help Center has the steps to follow to resolve these errors and set up your access policy: Managing access to unconfigured third-party apps for users <18
- Please also note: when creating a new OAuth scopes or a new client ID, you will need to configure the access level before data from users under 18 can be shared.
- The KA Client ID for you to use when configuring your access plan is: 179486897809-vot6i8d4ohsqvv7rui9vbjd53k6eo5mo.apps.googleusercontent.com
If you are experiencing technical issues or have further questions about the setting up an access policy for your school district, please reach out to the Khan Academy Support team!