Schoology

Log in to Schoology with a System Administrator account (not a teacher or school admin account). Click your name in the top-right corner → 'Settings' → select the 'API' tab from the Settings navigation. This tab is visible only to system administrator accounts — if it is missing, your account does not have system admin privileges and you must request access from the district's IT administrator. On the API page, you will see your OAuth consumer key (a alphanumeric string) and a reveal option for your consumer secret. Note both values carefully: the consumer key is like a username, and the consumer secret is like a password for the OAuth signing process. Store both in a password manager immediately — you will need them in the next step. Important: do NOT paste these directly into the API Connector header fields in Bubble, as the key field in the API Connector is not encrypted at rest. Instead, you will store them in Bubble's Environment Variables in Step 2. If your district's Schoology account does not show an API section, contact Schoology's support or your district's Customer Success Manager to confirm API access is enabled for your district's account.

1// Schoology OAuth 1.0a credentials location:
2// Log in as System Administrator
3// Your Name (top right) → Settings → API tab
4//
5// Consumer Key:    alphanumeric string (acts as username)
6// Consumer Secret: alphanumeric string (acts as password)
7//
8// Two-legged OAuth flow (no user token needed for admin access):
9// Authorization header parameters:
10//   oauth_consumer_key    = your consumer key
11//   oauth_signature_method = PLAINTEXT
12//   oauth_timestamp       = current Unix time in SECONDS
13//   oauth_nonce           = random unique string
14//   oauth_version         = 1.0
15//   oauth_signature       = YOUR_SECRET%26  (secret + ampersand, URL-encoded, no token)
16//
17// Full header format:
18// Authorization: OAuth realm="Schoology API",
19//   oauth_consumer_key="KEY",
20//   oauth_signature_method="PLAINTEXT",
21//   oauth_timestamp="1749000000",
22//   oauth_nonce="abc123def456",
23//   oauth_version="1.0",
24//   oauth_signature="SECRET%26"

With your Schoology consumer key and consumer secret at hand, open your Bubble app editor. In the left sidebar, click 'App Data' → 'Environment Variables.' This section stores key-value pairs that are encrypted at rest and available in Backend Workflows as Bubble expressions — they do not appear in plain text anywhere in the editor. Click 'Add a new environment variable.' Name: `SCHOOLOGY_CONSUMER_KEY`. Value: paste your Schoology consumer key. Click 'Save.' Add a second environment variable. Name: `SCHOOLOGY_CONSUMER_SECRET`. Value: paste your consumer secret. Click 'Save.' These variables are now accessible in Backend Workflow steps using the expression `App variable - SCHOOLOGY_CONSUMER_KEY` and `App variable - SCHOOLOGY_CONSUMER_SECRET`. By storing credentials here rather than hardcoding them in API Connector header fields, you prevent them from appearing in Bubble's editor UI in plain text, and you make it easy to rotate them later by updating a single Environment Variable rather than editing every API call. Note: Bubble Environment Variables are visible to anyone with editor access to your app — restrict editor access to trusted team members.

1// Bubble Environment Variables
2// App Data → Environment Variables
3//
4// Variable 1:
5//   Name:  SCHOOLOGY_CONSUMER_KEY
6//   Value: your_consumer_key_here
7//
8// Variable 2:
9//   Name:  SCHOOLOGY_CONSUMER_SECRET
10//   Value: your_consumer_secret_here
11//
12// Access in Backend Workflow steps:
13//   App variable - SCHOOLOGY_CONSUMER_KEY
14//   App variable - SCHOOLOGY_CONSUMER_SECRET
15//
16// These are NOT accessible in client-side workflows
17// (client-side workflows cannot read Environment Variables directly)
18// Always use them inside Backend Workflow steps only

Open the Plugins tab → API Connector → click 'Add another API.' Name this group 'Schoology.' Set the Root URL to `https://api.schoology.com/v1`. Under 'Shared headers,' click 'Add a shared header.' Key: `Authorization`. For the value, you cannot type a static string here because the OAuth header must include a current timestamp and a fresh nonce with every call. Instead, type a placeholder: `<dynamic>` — or leave it as an empty initial value. Check the 'Private' checkbox. You will complete the actual value by passing it as a dynamic parameter from the Backend Workflow in Step 4. Now add a second API call inside this group. Click 'Add call.' Name it 'Get Courses.' Method: GET. Endpoint: `/courses`. Set 'Use as' to 'Data.' Add a 'Parameters' entry named `Authorization` (this may need to be a header-level override — in Bubble's API Connector, you can add call-level header overrides that replace the shared header value for that specific call). The OAuth header value will be set dynamically from the calling Backend Workflow. Before initializing, note that Bubble's Initialize call will fail unless you manually provide a valid OAuth header string during initialization. Prepare a manually computed test header string using the format from Step 1 with a current timestamp — this is only needed once for initialization. Alternatively, complete Step 4 first (build the header-generation workflow), run it to produce a valid header, and then use that output to initialize the API call.

1// Bubble API Connector — Schoology group
2{
3  "api_group_name": "Schoology",
4  "root_url": "https://api.schoology.com/v1",
5  "shared_headers": [
6    {
7      "key": "Authorization",
8      "value": "<dynamic — set per call from Backend Workflow>",
9      "private": true
10    }
11  ],
12  "calls": [
13    {
14      "name": "Get Courses",
15      "method": "GET",
16      "endpoint": "/courses",
17      "use_as": "Data"
18    },
19    {
20      "name": "Get Section Enrollments",
21      "method": "GET",
22      "endpoint": "/sections/<section_id>/enrollments",
23      "parameters": [
24        { "key": "section_id", "type": "dynamic" }
25      ],
26      "use_as": "Data"
27    },
28    {
29      "name": "Get Section Grades",
30      "method": "GET",
31      "endpoint": "/sections/<section_id>/grades",
32      "parameters": [
33        { "key": "section_id", "type": "dynamic" }
34      ],
35      "use_as": "Data"
36    }
37  ]
38}

This is the most technically demanding step. You will build a Bubble Backend Workflow that assembles the OAuth 1.0a Authorization header string dynamically before making any Schoology API call. Go to the Backend Workflows section in your Bubble editor (requires paid plan — Settings → API → enable Workflow API first). Create a new Backend Workflow named 'Call Schoology API.' Add an input parameter: `endpoint` (text — the Schoology path to call, e.g., `/courses`). Inside the workflow, build the OAuth components as text expressions: Timestamp: use Bubble's `Current date/time:formatted as Unix (10 digit)` — this gives seconds. Nonce: use `Current date/time:formatted as` a long millisecond value, or use a random number expression — the nonce just needs to be unique per call. Consumer key: reference `App variable - SCHOOLOGY_CONSUMER_KEY`. Consumer secret: reference `App variable - SCHOOLOGY_CONSUMER_SECRET`. Signature: for PLAINTEXT method, the signature is `[consumer_secret]%26` — the secret URL-encoded with a percent-encoded ampersand at the end (no token secret). Now assemble the full header string in a 'Set state' or a text expression: `OAuth realm="Schoology API", oauth_consumer_key="[key]", oauth_signature_method="PLAINTEXT", oauth_timestamp="[timestamp]", oauth_nonce="[nonce]", oauth_version="1.0", oauth_signature="[secret]%26"`. Store this assembled string in a Custom State or Workflow output. Then add an API Connector step: Schoology - Get Courses (or whichever endpoint this workflow targets), passing the assembled OAuth header string as the Authorization header override value. If RapidDev's team has built Schoology integrations before with this header-generation pattern, a free scoping call at rapidevelopers.com/contact can confirm the exact Bubble expression chain for your district's Schoology instance.

1// Backend Workflow: 'Call Schoology Courses'
2// Requires: paid Bubble plan (Backend Workflows)
3//
4// Step 1: Compute OAuth components
5// timestamp = Current date/time:formatted as Unix timestamp (seconds, 10 digits)
6// nonce     = Current date/time:formatted as Unix ms + random suffix
7//             OR: unique ID expression truncated to 12 chars
8// consumer_key    = App variable - SCHOOLOGY_CONSUMER_KEY
9// consumer_secret = App variable - SCHOOLOGY_CONSUMER_SECRET
10//
11// Step 2: Assemble OAuth header string
12// oauth_header =
13//   "OAuth realm=\"Schoology API\","
14//   + " oauth_consumer_key=\"" + consumer_key + "\","
15//   + " oauth_signature_method=\"PLAINTEXT\","
16//   + " oauth_timestamp=\"" + timestamp + "\","
17//   + " oauth_nonce=\"" + nonce + "\","
18//   + " oauth_version=\"1.0\","
19//   + " oauth_signature=\"" + consumer_secret + "%26\""
20//
21// Step 3: Call Schoology API Connector
22// Call: Schoology - Get Courses
23// Header override: Authorization = [assembled oauth_header]
24//
25// Sample assembled header:
26// OAuth realm="Schoology API", oauth_consumer_key="abc123key",
27// oauth_signature_method="PLAINTEXT", oauth_timestamp="1749001234",
28// oauth_nonce="x7k2m9p4", oauth_version="1.0", oauth_signature="mysecret%26"

With the OAuth Backend Workflow working, build the district dashboard UI. Create a Bubble Data Type named 'SectionGradeSnapshot' with fields: `section_id` (text), `section_name` (text), `course_name` (text), `school_name` (text), `enrollment_count` (number), `average_grade` (number), `pass_rate` (number), `snapshot_date` (date). Build a Backend Workflow named 'Sync Section Grades' that loops through a list of active section IDs, calls Schoology's `/sections/{id}/grades` for each one (via the OAuth header workflow from Step 4), calculates the average grade from the returned array of grade records, and creates or updates a SectionGradeSnapshot record for each section. Important: Schoology timestamps in API responses are Unix epoch seconds — when storing date values in Bubble, multiply the Schoology timestamp by 1000 to convert to milliseconds before using Bubble's date conversion: use the expression `[schoology_timestamp] * 1000` and then format as a Bubble date. Schedule the 'Sync Section Grades' workflow to run nightly (requires paid Bubble plan). On your dashboard page, add a Repeating Group with 'Type of content: SectionGradeSnapshot' and 'Data source: Search for SectionGradeSnapshots.' Add dropdown filters for school name and course name. Add sorting by average_grade ascending to surface the lowest-performing sections at the top.

1// Bubble Data Type: SectionGradeSnapshot
2// Fields:
3//   section_id       (text)   — Schoology section ID
4//   section_name     (text)   — e.g., 'Period 3 - Algebra I'
5//   course_name      (text)   — e.g., 'Algebra I'
6//   school_name      (text)   — school within the district
7//   enrollment_count (number) — number of enrolled students
8//   average_grade    (number) — 0-100
9//   pass_rate        (number) — percentage passing (grade >= 60)
10//   snapshot_date    (date)   — when this snapshot was taken
11//
12// IMPORTANT: Schoology timestamp conversion
13// Schoology returns timestamps in Unix SECONDS
14// Bubble uses milliseconds for date arithmetic
15//
16// Correct conversion in Bubble expression:
17//   schoology_timestamp_field * 1000
18//   → then use ':formatted as' to display as readable date
19//
20// Wrong (shows 1970 dates):
21//   schoology_timestamp_field  (raw seconds, no multiplication)
22//
23// Dashboard Repeating Group data source:
24//   Search for SectionGradeSnapshots
25//   :filtered where school_name = Dropdown School's value
26//   :sorted by average_grade ascending

Schoology data includes student grade records, enrollment information, and personal details such as student names and IDs. In the United States, K-12 student records are protected by FERPA (Family Educational Rights and Privacy Act). Bubble's database, without privacy rules, allows any logged-in user of your app to query stored data types via Bubble's native API. Apply strict privacy rules to every Data Type that stores Schoology data. In the Bubble editor, go to Data tab → Privacy. For 'SectionGradeSnapshot': create a rule that applies when 'Current User's role = Administrator or Current User's role = Counselor' (or however you implement roles in your Bubble User type). Under 'When this rule applies,' check 'Find this in searches' and 'See all fields.' Under 'When rule does not apply,' uncheck everything. Repeat for any student-level Data Types. Add role management to your Bubble User type: a 'role' option set or a 'is_district_admin' yes/no field. Set these roles only through admin-controlled workflows, never through user-editable form fields. Because this Bubble app likely handles FERPA-protected data, restrict app access to district staff only — add authentication (Bubble's built-in auth or a provider like Auth0) and ensure the app URL is not publicly shared. District IT policy may also require that the Bubble app itself is hosted within an approved vendor agreement.

1// Bubble Privacy Rules — Schoology Data Types
2// Data tab → Privacy → SectionGradeSnapshot
3//
4// Rule: 'District Staff Only'
5// Condition: Current User's is_district_staff = yes
6//
7// When rule applies:
8//   [x] Find this in searches
9//   [x] See these fields → All Fields
10//
11// When rule does NOT apply:
12//   [ ] Find this in searches    (blocked)
13//   [ ] See any fields           (blocked)
14//
15// Bubble User type additions:
16//   is_district_staff  (yes/no, default: no)
17//   role               (Option Set: Administrator, Counselor, Viewer)
18//
19// FERPA note:
20// Any Bubble app displaying K-12 student records should be
21// accessed only by authorized district personnel.
22// Ensure login is required — no public/anonymous access to
23// any page that can display student data.