The Credentials Portal API supports two authentication methods: session tokens (for user sessions) and API keys (for programmatic integrations).
API keys (recommended for integrations)
API keys are long-lived credentials designed for server-to-server integrations. Create and manage them from Settings → API Keys in the app (admin access required).
API keys use the prefix ck_ followed by a random string:
Using an API key
Include the key as a Bearer token in the Authorization header:
API key scopes
Each key is created with specific scopes that limit what it can do:
Store API keys securely. They grant access to your district’s data. Revoke any key that may have been compromised from Settings → API Keys.
Session tokens (for user-facing apps)
Session tokens are issued after a user completes email verification. They expire after 30 days.
Request a login code
Response:
Verify the code
Response:
Verify via magic link
Users clicking the magic link in their email hit:
This returns the same response as code verification.
Sign out
Response:
Token TTLs
Get the current user
Response: