If your school has its own website, it can pull events and posts straight from Schola rather than anyone re-typing them. Settings → API keys is where you create the key that authorises those requests.
What the API covers
- Events — list them, or fetch one.
- Posts — list them, or fetch one.
- Attendance capture — for card readers and gate hardware sending scans in.
Everything else stays inside Schola. The read endpoints only return content you've already published, so nothing private is exposed by connecting your website.
Full technical reference is at Settings → API keys → Documentation, which is the page to hand your developer.
Creating a key
- Go to Settings → API keys.
- Click New key.
- Give it a name you'll recognise later — School website, Gate reader.
- Optionally restrict allowed origins to the domains that may use it from a browser.
- Copy the key.
The full key is shown once. After you close the dialog you'll only ever see the first few characters, which are there to help you tell keys apart. If it's lost, revoke it and make a new one.
Allowed origins
If the key will be used by JavaScript in a browser, list the domains permitted to call with it — for example https://www.yourschool.com. Requests from anywhere else are refused.
A key used only from a server doesn't need this, and is safer for it. A key sitting in browser code is readable by anyone who views the page, which is why the read endpoints are the only ones worth using that way.
Keeping track
The list shows when each key was created and when it was last used. A key with no recent use is usually one you can revoke.
Revoking
Click Revoke. It stops working immediately and can't be brought back. Anything using it breaks at once, so check the last-used date first.
Revoke straight away if a key has been posted publicly, committed to a repository, or shared with someone who no longer works with you.