Skip to main content
The Credentials Portal API supports two authentication methods: session tokens (for user sessions) and API keys (for programmatic integrations). API keys are long-lived credentials designed for server-to-server integrations. Create and manage them from Settings → API Keys in the app (admin access required). API keys use the prefix ck_ followed by a random string:

Using an API key

Include the key as a Bearer token in the Authorization header:

API key scopes

Each key is created with specific scopes that limit what it can do:
Store API keys securely. They grant access to your district’s data. Revoke any key that may have been compromised from Settings → API Keys.

Session tokens (for user-facing apps)

Session tokens are issued after a user completes email verification. They expire after 30 days.

Request a login code

Response:

Verify the code

Response:
Users clicking the magic link in their email hit:
This returns the same response as code verification.

Sign out

Response:

Token TTLs

Get the current user

Response: