How to Integrate Bolt.new with Schoology

Schoology API credentials are not self-service — they must be issued by a Schoology administrator at your school or district. There are two types of API access in Schoology: System credentials (school-admin level): A single consumer key and secret that can access data for all users in the school. Created by a Schoology admin going to System Settings → API → Register New App. This is what you need for building dashboards that aggregate data across students or courses. The admin gives your app a name, description, and callback URL, then provides you with the consumer key and secret. User credentials (individual level): Each user can generate their own OAuth credentials in My Resources → Apps & External Tools. These only provide access to that user's data. Useful for personal tools but not for multi-student or teacher dashboards. To request system credentials: contact your school's Schoology administrator (usually the district IT department or LMS coordinator). Explain what data you need to access (courses, assignments, grades) and what you're building. They will create an API application in Schoology's admin settings and share the consumer key and consumer secret with you. For developers building commercial products for schools: the Schoology Partners program allows you to list your app in Schoology's App Center, which simplifies the authorization process for each school that wants to connect. Contact developers@schoology.com for partnership information.

1# Schoology API base URL:
2# https://api.schoology.com/v1/
3
4# Key endpoints:
5# GET /users/{userId}/sections         — courses/sections a user is enrolled in
6# GET /sections/{sectionId}            — single course section details
7# GET /sections/{sectionId}/assignments — assignments in a section
8# GET /sections/{sectionId}/grades     — grade data for a section
9# GET /sections/{sectionId}/enrollments — enrolled students
10# GET /users/me                        — current user info
11
12# Authentication: OAuth 1.0a
13# Header format: OAuth realm="Schoology API", oauth_consumer_key="...", oauth_signature="...", ...

OAuth 1.0a is more complex to implement than OAuth 2.0 because every API request must be individually signed. The signature is a HMAC-SHA1 hash of the request parameters combined with your consumer secret. This prevents request tampering and authenticates each API call. The signing process: (1) collect all OAuth parameters (consumer_key, nonce, signature_method, timestamp, version) plus any query parameters; (2) percent-encode and sort them alphabetically; (3) build the signature base string: HTTP_METHOD + '&' + encoded_URL + '&' + encoded_params; (4) sign the base string using HMAC-SHA1 with the consumer_secret as the key; (5) add the signature to the Authorization header. The oauth package (npm) and oauth-1.0a package both handle this for you. The oauth-1.0a package is lighter and easier to use for REST API calls — it's pure JavaScript, works in Bolt's WebContainer, and handles all the encoding and signing. Install it with the crypto module from Node.js for the HMAC implementation. All signing happens server-side in your API routes, keeping the consumer secret out of client code.

1// lib/schoology.ts
2import OAuth from 'oauth-1.0a';
3import crypto from 'crypto';
4
5const BASE_URL = 'https://api.schoology.com/v1';
6
7const oauth = new OAuth({
8  consumer: {
9    key: process.env.SCHOOLOGY_CONSUMER_KEY!,
10    secret: process.env.SCHOOLOGY_CONSUMER_SECRET!,
11  },
12  signature_method: 'HMAC-SHA1',
13  hash_function(base_string, key) {
14    return crypto.createHmac('sha1', key).update(base_string).digest('base64');
15  },
16});
17
18export async function schoologyFetch<T>(
19  path: string,
20  method: 'GET' | 'POST' | 'PUT' | 'DELETE' = 'GET',
21  body?: object
22): Promise<T> {
23  const url = `${BASE_URL}${path}`;
24  const requestData = { url, method };
25
26  const authHeader = oauth.toHeader(oauth.authorize(requestData));
27
28  const response = await fetch(url, {
29    method,
30    headers: {
31      ...authHeader,
32      'Content-Type': 'application/json',
33    },
34    body: body ? JSON.stringify(body) : undefined,
35  });
36
37  if (!response.ok) {
38    const text = await response.text();
39    throw new Error(`Schoology API ${response.status}: ${text}`);
40  }
41
42  return response.json() as Promise<T>;
43}

With the authenticated Schoology client, create the API routes for fetching educational data. The most commonly needed endpoints are: the current user's enrolled sections (courses), assignments within a section, and grade data. Schoolgy's API returns paginated results with a total, next, and links structure. Most list endpoints default to 20 items per page. Use the start and limit query parameters to control pagination — start is the offset (0-indexed) and limit is how many records to return (max 200 for most endpoints). For building dashboards, fetch all records by looping until you get an empty next link. The /users/me endpoint returns the authenticated user's details including their uid. Use this uid to fetch their enrollments: /users/{uid}/sections returns all course sections the user is enrolled in. Each section has a section_id, course_title, section_title, access, and grading_period. Then use section_ids to fetch assignments and grades from /sections/{section_id}/assignments and /sections/{section_id}/grades.

1// app/api/schoology/sections/route.ts
2import { NextResponse } from 'next/server';
3import { schoologyFetch } from '@/lib/schoology';
4
5interface SchoologyUser { uid: string; name_display: string; }
6interface SchoologySection {
7  id: string;
8  course_title: string;
9  section_title: string;
10  section_code: string;
11  grading_period: string;
12  access: string;
13}
14
15export async function GET() {
16  try {
17    const user = await schoologyFetch<SchoologyUser>('/users/me');
18    const data = await schoologyFetch<{ section: SchoologySection[] }>(
19      `/users/${user.uid}/sections?limit=100`
20    );
21    return NextResponse.json(data.section || []);
22  } catch (error: unknown) {
23    const e = error as { message: string };
24    return NextResponse.json({ error: e.message }, { status: 500 });
25  }
26}

The Schoology dashboard brings together course grades, upcoming assignments, and recent activity into a unified view. Design for two primary audiences: students checking their own progress and parents monitoring their child's performance. For the course overview, display each section as a card with the course name, current grade (letter grade and percentage), and a grade trend indicator. Schoology's grade data comes back as a flat list of grade items — you need to calculate the overall course grade by aggregating the graded items based on their grading category weights if applicable. For the assignments view, sort by due date and group by urgency: overdue (past due date, not submitted), due soon (next 3 days), and upcoming (rest of the week and beyond). Use red/yellow/green color coding. Assignments from Schoology include: title, due date, maximum points, assignment type, and section ID. Link each assignment card back to the Schoology web URL (constructable from section_id and assignment_id) so students can click through to submit work. Authentication context: for parent dashboards, the API credentials are the student's, and the parent sees the student's data. If building for parents, you need either the student to authorize the app (user-level credentials) or a system-level credential that allows the app to query on behalf of specific users.