Create, rotate, and revoke API keys

Use one named key per integration and environment. The complete credential is shown once; Waqar later displays only safe identifying and lifecycle metadata.

1. As a school administrator, open Settings.
2. Find API key management and confirm that API access is available.
3. Open the rendered API documentation and agree on the minimum scopes with the integrator.
4. Enter a name that identifies the system, environment, and owner.
5. Set an expiration date when the integration lifecycle permits.
6. Select only the required scopes.
7. Choose Create API key.
8. Copy the displayed credential immediately to the approved secret manager.
9. Close the reveal and verify the key’s name, safe identifier, scopes, creation time, expiration, and last-used state in the inventory.

The full credential is not shown again after refresh. If it is lost, create a replacement; it cannot be recovered.

Each scope may appear only once in a submission. Duplicate values—including a case-variant duplicate—are rejected before a key, audit event, or credential is created. The key controls reflow at narrow widths and browser zoom; the one-time value wraps inside its protected reveal instead of widening the page.

• Prefer direct insertion into the integration’s secret manager.
• Never send it in chat, email, a ticket, source control, a screenshot, or a wiki page.
• Do not give a production key to browser code or a developer workstation.
• Record the human owner and intended service separately from the secret.

1. Create a replacement with the required current scopes.
2. Install it in the integration without removing the old key.
3. Make a small authenticated request and verify the expected school.
4. Watch the new key’s last-used metadata.
5. Revoke the old key.
6. Confirm that the integration continues with the replacement.

Scopes and expiration are immutable. Rotation is also the way to add a newly released scope; existing keys never gain one automatically.

Choose Revoke for the exact key, confirm its safe identifier, and verify that it is marked revoked. Revocation is immediate and cannot be undone. Create a replacement if access is needed again. If a browser retries the same revocation submission, Waqar treats it as a safe replay: the key remains revoked and no duplicate transition audit event is created. An invalid or unavailable key reference shows the localized not-found page and does not change another school’s key.

Check expiration, revocation, required scope, school eligibility, suspension, quota, rollout, and any configured source-network restriction. If a CIDR restriction is active, coordinate before changing integration egress.

See authentication and scopes and errors and quotas.