Kami team update on Jan 09, 2026:
The issue has been resolved. We identified that the issue was causing the aforementioned error because our servers were being flagged as non-US-based, even though they are US-based. This problem has affected some Districts/Schools in the US that have configured their Google domain with a CAA (Context-Aware Access) policy.
For any domains that granted Kami a CAA exemption as a temporary measure, they may now choose to revoke this exemption. Once revoked, we strongly advise in monitoring the CAA Log Events for any persisting issue.
Kami team update on Jan 05, 2026:
Kami is aware of the current Google Authentication "invalid authorization code" error when accessing documents and logging in. Our engineering team has prioritised investigating the cause of this problem.
Who can do this?
👤 The steps in this guide require Google Admin access.
We'll walk through the steps to enable Kami as an approved app. Please note, this is a separate requirement from deploying Kami Chrome Extension, and Google Workspace Marketplace App, and the other Kami Network Requirements.
Configure access to Kami via the Google Admin Console
1. Setting up API controls
Before we apply the authorization changes, we must verify that the API settings are configured correctly. Please follow these steps and ensure everything matches the screenshots.
To get started, go to the side panel of your Admin Console and click Security > Access and Data control > API controls to access your API settings.
Then, click anywhere in the Settings section to expand it.
Select Unconfigured third-party apps to expand this section.
Find the Settings for users under 18 permissions, and adjust this to the permission that best suits your organization's Policy.
2. Confirm settings for configured third-party apps
After saving, you will be returned to the App access control page. Select Manage App Access.
Select the Apps Pending Review option.
On the next page, use the search bar to type "Kami". A drop-down option will appear to filter by App names containing "Kami".
This should return 13 Kami app options. Select all 13, then click the Change access button.
🔍 If you can't see the Kami App under Apps Pending Review, it may already be under the Configured Apps. Check there and confirm that the app is configured as Trusted. (Note: There may be multiple Kami entries; ensure all are set to Trusted).
3. Configure Access for Kami
Making sure that Kami is set to Trusted.
On the first page, you can configure the scope of whose access will be modified. All users in your domain will be selected by default; you can also select specific org units.
Once finished, select the Next button.
On the next page, you can configure the Kami app's access to Google Data for the selected users.
Select Trusted, then select the Next button.
🔍 On rare occasions, a potential issue may arise relating to the traffic being blocked due to the domain's CAA (Context-Aware Access) policy, such as an "Invalid Authorization Code" error, when a user tries to load a document or log in to the Kami app. We strongly recommend reviewing your CAA Log Events to investigate further. The exempt rule shown in the screenshot above can be used to confirm the issue's relation to the CAA policy and as a temporary fix.
Please contact us at support@kamiapp.com if this issue or a similar one occurs.
On the next page, review your changes, then select Change Access.
A pop-up window will open with the parental consent form. Read through this form, then select Confirm.
Once this is finished, you're all set! Your users' access has now been confirmed. Keep in mind that these changes may take some time to take effect.
Learn more about adding Kami to the allowlist for Google Advance Protection, and deploying Kami Chrome Extension, and Google Workspace Marketplace App.
If you need further assistance, don't hesitate to get in touch with us at support@kamiapp.com or book training with one of our Teacher Success Champions.