Skip to content

Clever SSO returns students without email addresses to Guest #7081

Description

@phiniki

Describe the bug

Students can sign in to Clever successfully using QR codes / Clever Badges, but after selecting Sign in > Clever in Microsoft MakeCode for micro:bit and completing the Clever authorization flow, they are redirected back to MakeCode and remain signed out as Guest.

Teacher accounts in the same district can sign in successfully. The affected student accounts do not have email addresses populated.

Clever's Troubleshoot Login reports that:

  • the student logged in to Clever successfully;
  • the app is in the Library;
  • the student is shared with the app;
  • the student's email address is not populated; and
  • the likely issue is with the app's Library integration.

Clever documents that email is not guaranteed for users and recommends using the Clever User ID as the primary identifier:
https://dev.clever.com/docs/users

Steps to reproduce

  1. Use a Clever student account whose email field is not populated.
  2. Sign in to Clever successfully with a QR code / Clever Badge.
  3. Open Microsoft MakeCode for micro:bit from Clever, or select Sign in > Clever in MakeCode.
  4. Complete the Clever authorization flow.
  5. Observe that MakeCode returns to https://makecode.microbit.org/#, but the user is still shown as Guest.

Expected behavior

The student should be signed in to the same MakeCode cloud account and should be able to access their existing cloud projects.

Actual behavior

The student remains signed out as Guest, so their previously saved cloud projects are inaccessible.

Environment and observations

  • Reproduced in Chrome, Safari, and Microsoft Edge
  • No HTTP 4xx responses were observed during the sign-in flow
  • Student QR/Clever login itself succeeds
  • Clever's diagnostic confirms the student is shared with the app
  • Teacher accounts with populated email addresses can sign in
  • The issue was first discovered on August 19, 2026, when the students attempted final adjustments before a contest deadline; the exact start time of the authentication failure is unknown
  • The browser console shows only unrelated permissions-policy and duplicate block-definition warnings

A similar sign-in incident was reported in #7002. Could this be a recurrence or a regression affecting Clever users without email addresses?

Please also advise whether the students' existing cloud projects remain associated with their Clever user IDs and can be recovered once the authentication issue is fixed.

No student names, Clever IDs, email addresses, school name, or district identifier are included in this report.

Metadata

Metadata

Labels

Type

Projects

No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions