Authentication

The Authorization header

Send the key as a bearer token on every request, over HTTPS. There are no sessions or cookies: each request stands alone.

GET https://api.school360.cloud/v1/school
Authorization: Bearer s360_live_Xy3…
Accept: application/json

API keys

The school's owner or admin creates keys in School Setup › Integrations › API keys (the Enterprise package, or switched on by School360). A key has:

• a name, so you know which system uses it;
• a permission for each resource: none, read or write (students, families, attendance, fees, exams, staff, admissions, gate, notices; salaries for pay details);
• optionally one campus: the key then sees and changes that campus only;
• optionally IP addresses or ranges it may be used from, and an expiry date.

The full key is shown once, when it is made. School360 keeps only its SHA-256 hash, so a lost key can't be shown again: make a new one.

Live and test keys

Live keys start with s360_live_. Test keys (s360_test_…) work only on the Demo School, so you can build against realistic data without touching a real school; using one anywhere else answers 401 test_key_not_allowed.

IP allow-lists and expiry

A key with an IP allow-list answers 403 ip_not_allowed to calls from any other address: give one to keys that live on a server with a fixed address (a bank connector, the attendance PC). Give short-lived keys an expiry date; after it they answer 401 key_expired.

Rotating and revoking

To replace a key, create the new one, switch your system to it, then revoke the old one. Revoking takes effect at once: the next call with it answers 401 key_revoked. Give each system its own key, so you can revoke one without stopping the others.

Never put a key in a website's or mobile app's code, where anyone can read it. Call the API from your own server.