For school IT

Allowing Mascot at your school

What it reads, where the data goes, and the client ID to allow it. Last updated 11 September 2026

A student would like to use Mascot, a free macOS app that shows their Google Classroom deadlines as a capybara in the Dock. It reads their own coursework, read-only, directly from Google. No Mascot server receives it. If your domain blocks third-party apps an admin has not configured, which is common for students designated as under 18, Google shows the student "Access blocked" until the app is configured.

At a glance

App: Mascot for macOS. Google’s consent screen shows the name Mascot and studymascot.com, brand verified by Google.
OAuth client ID: 94177684324-8dl7pbohtlndrnu1ao8ar6kt29i34das.apps.googleusercontent.com
Client type: Installed desktop app. The student signs in on Google’s own page in their browser (PKCE, loopback redirect to 127.0.0.1). Mascot never sees the password.
Google access: Read-only. Three Classroom scopes limited to the student’s own work, plus openid and email. No write access, no admin scopes, no domain-wide delegation.
Where data goes: From Google straight to the student’s Mac, held in memory while the app runs. Not uploaded anywhere.
Publisher: An independent developer. Thanachot10072550@gmail.com
Privacy policy: studymascot.com/privacy. No ads, no analytics, no third-party SDKs. Free.

Allow it in two minutes

Sign in to admin.google.com as an admin who can manage app access.
Go to Security → Access and data control → API controls, then click Manage App Access. (Older consoles call it Manage Third-Party App Access.)
Under Configured apps, click Configure new app, paste the client ID above, click Search and choose Mascot.
For Scope, pick the organisational units your students are in, or leave the top level for everyone. Click Continue.
For Access to Google data, choose Specific Google data and select the five scopes listed below. That grants exactly what Mascot asks for and nothing else. Limited also works if Classroom is not a restricted service in your domain. Trusted is more than it needs.
Click Continue, check the summary, then Finish.

Google says changes can take up to 24 hours but usually apply sooner. The student then right-clicks the mascot and chooses Sign In to Google Classroom… again.

Rather approve case by case? If Allow users to request access to apps for themselves is on for students, a blocked student can press Request access on Google’s page, and Mascot appears under Apps pending review.

What it asks Google for

Scope	What Mascot does with it
`https://www.googleapis.com/auth/classroom.courses.readonly`	Lists the classes the student is in, so deadlines can be labelled by class.
`https://www.googleapis.com/auth/classroom.coursework.me.readonly`	Reads the work assigned to the student and its due dates.
`https://www.googleapis.com/auth/classroom.student-submissions.me.readonly`	Checks whether the student has turned each piece in, so finished work stops causing reminders.
`openid`, `email`	Identifies which account is connected, so a Classroom link opens in the matching browser account instead of a personal one. The address stays in memory on the Mac.

Mascot cannot:

create, edit, submit, grade or delete anything in Classroom;
see other students, their work, class rosters or teacher-only material;
read Drive, Gmail, Google Calendar or any Google service other than Classroom;
act on the domain: it holds no admin scope and asks for no delegation.

Where the data goes

Sign-in happens on Google’s page in the student’s browser. The resulting token is kept in the Mac’s Keychain.
Coursework is fetched from Google’s APIs by the app itself and kept in memory while it runs. It is not written to disk and not sent to any Mascot server.
No tracking. No analytics, no advertising, no usage data. Use of Google data follows the Google API Services User Data Policy, including the Limited Use requirements.
Crash reports are sent only if the student clicks Send after seeing the exact text. They contain version numbers and function names, nothing about the student.
Removing access. Sign Out of Classroom in the app deletes the token at once. You can also set Mascot to Blocked in the Admin console, which ends its access for every account in scope.

Network, for firewalls and filters

Host	When
`accounts.google.com` `oauth2.googleapis.com` `openidconnect.googleapis.com`	Signing in and renewing the session.
`classroom.googleapis.com` `www.googleapis.com`	Reading coursework.
`studymascot.com`	A version check once a day, and the mascot store when the student opens it. Neither carries anything about the student.
`fcyhiujhvafozihopxsu.supabase.co`	Optional features only: a crash report the student chose to send, or an account for publishing a mascot drawing. Coursework never goes here.
`github.com`	Downloading the app. GitHub hands the file over from its own download servers.

On the Mac

Requirements: Apple silicon (M1 or later), macOS 14 or later.
Bundle ID: com.poupav.mascot
What installs: One app from a zip. No installer package, no system extensions, no background daemons. A student without admin rights can run it from the Applications folder inside their home folder.
Permissions: All optional, each asked only when the student turns that feature on: Calendar and Reminders (one chosen calendar or list), and Accessibility, used only to find where the Dock is.
At login: Opens at login, listed under System Settings → General → Login Items where it can be switched off.
Signing: Signed with the hardened runtime. Not yet notarised by Apple: macOS asks the student to confirm the first time it opens, and a policy that only allows notarised apps will stop it. Notarisation is planned.

Questions

Mascot is made by one person. School IT questions are welcome, and if something here does not match what you see in your console, I would like to know: Thanachot10072550@gmail.com.