Getting API credentials
Issue credentials from Settings, API Keys. Each key is scoped to the roles it inherits, so a key carries the same permissions as the user who created it.
Warning
Treat API keys like passwords — never embed them in client-side code or public repositories.
Authentication
Authenticate with a bearer token in the Authorization header on every request.
- Send your key to the token endpoint.
- Receive a short-lived access token.
- Include it as: Authorization: Bearer <token>.
Webhooks
Subscribe to events to be notified the moment they happen. Each delivery is a signed POST payload that you acknowledge.
- Choose events such as bill.created or student.updated.
- Provide your HTTPS endpoint.
- Verify the HMAC signature before processing.
- Return 200 quickly to avoid retries.
Tip
Store your secret securely and verify every signature — this protects your endpoint from forged events.