What this does and why

Content Manager can import events from Google Calendar so that they appear as content on your sites alongside other school content. The integration is read-only: it pulls event titles, descriptions, locations, and timestamps from calendars you choose. It does not create, modify, or delete events.

To pull calendar data without each user having to sign in, our service account uses Google's domain-wide delegation to read calendars on behalf of one Google account that you designate. Domain-wide delegation:

• Authorizes one specific service account, identified by a Client ID, to act on behalf of users in your domain.
• Is scope-limited: we can only call the OAuth scopes you explicitly grant.
• Does not give us the user's password.
• Limits what we can see to what the designated account can see. To read a given calendar, that account must have access to it.

Already set up Google Directory Authentication? You will recognize Steps 1–3 since they configure the same service account. You can either add the calendar scopes to your existing Content Manager API clients entry, or create a new one. The user account in Step 4 can be the same account used for directory sync, as long as that person has access to the calendars you want imported.

What you will do

1. Authorize the Content Manager service account's Client ID with three calendar scopes.
2. Designate a Google account that has read access to each calendar to be imported.
3. Share each calendar with that account if it is not already an attendee or owner.
4. Send the account's email address, plus the Calendar IDs to be imported, to Imagine Everything.

Prerequisites

• Super admin access to https://admin.google.com.
• The Calendar ID of each calendar you want imported. You can find this in Google Calendar under the calendar's Settings and sharing → Integrate calendar → Calendar ID (it looks like an email address, for example c_a1b2c3@group.calendar.google.com or school@yourdomain).

Step 1. Open Domain-Wide Delegation

1. Go to Google Admin Home.
2. Click Security.
3. Scroll to and click API controls.
4. Under Domain wide delegation, click MANAGE DOMAIN WIDE DELEGATION.

Step 2. Authorize the Content Manager service account

1. Click Add new. (If you already created a Content Manager entry during directory authentication setup, open that entry instead and add the scopes below to it.)

2. In Client ID, enter:

   111045640482053254535

   This is the unique identifier for the Content Manager service account. Granting it scopes here tells Google "this specific service account is allowed to use the listed APIs in our domain."

3. In OAuth scopes (comma-delimited), paste the following:

   https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/calendar.events,https://www.googleapis.com/auth/calendar.calendarlist.readonly

   What each scope is used for:

   Scope	Purpose
   calendar	Required by Google's Calendar API client to access calendars the user can see.
   calendar.events	Required to list events on a calendar.
   calendar.calendarlist.readonly	Read the user's calendar list to validate Calendar IDs before import.

   A note on scope breadth: The calendar and calendar.events scopes are written by Google as full-access scopes (they include both read and write in their string), but the Content Manager integration only calls the list and read endpoints. It does not create, update, or delete events. The account you designate in Step 4 is the actual access boundary — we can only read calendars that account can read.

4. Click AUTHORIZE.

Step 3. Verify

You should now see Content Manager listed under API clients with the three calendar scopes attached. If you added these scopes to an existing entry that already had directory scopes, you will see all of them listed together.

Step 4. Designate the user whose calendars we will read

Domain-wide delegation requires us to act on behalf of a real Google account in your domain. We will impersonate this account to read the calendars you want imported. We never see its password.

The account you designate must have read access to each calendar you want imported. Calendar permissions in Google Workspace are per-calendar, not domain-wide, so this is something you set up in Google Calendar itself (not in the Admin console).

1. Choose an existing user, or create a new one. We recommend a dedicated account such as contentmanager-sync@yourdomain so that audit logs clearly attribute calendar reads to the integration rather than a person. If you already designated an account during directory authentication setup, you can reuse it — just make sure it has access to the calendars in the next step.

2. For each Google Calendar you want Content Manager to import:

   • Open the calendar in Google Calendar.
   • Go to Settings and sharing → Share with specific people or groups.
   • Add the account from Step 1 with See all event details permission.

   Read access is sufficient. The integration does not need "Make changes to events" or "Make changes and manage sharing."

3. Send the following to Imagine Everything:

   • The email address of the account from Step 1.
   • The Calendar ID of each calendar to be imported.

What Imagine Everything needs from you

• The email address of the designated account (Step 4).
• The Calendar ID of each calendar to be imported.

What we will not do

• We will not create, modify, or delete events on any calendar.
• We will not access mail, drive, directory, or any other Google service through this authorization. Directory sync is configured separately, in "Enabling Google Directory Authentication for Content Manager."
• We will not access calendars the designated account does not have access to.
• We will not retain the impersonated account's password (we never receive it).