Access keys

The access key identifies the school and says what the integration can do. It is created by the school's account owner in the EduPay panel, under Integrations → API Tokens.

Create#

1. In Integrations → API Tokens, click Create token.
2. Name: say where the key will be used ("Finance ERP", "Website — enrollments"). This is how the school recognizes the key later.
3. Permissions: pick a ready-made bundle in Scope preset or tick them one by one. Give only what the integration needs. See Permissions.
4. Expiration: no expiration, 30, 90, 180 or 365 days. Once expired, the key stops working.
5. Copy the key. It starts with edp_ and is shown only once. If you lose it, create another one.

The public API must be turned on in the same place (Public API (v1) box). While it is off, every call to /api/v1 returns 403 with code api_disabled.

Use#

Send the key in the Authorization header of every call:

curl https://edupay.estudiosite.com/api/v1/me \
  -H "Authorization: Bearer $EDUPAY_KEY"

• One key per integration. If one leaks, only that one needs to be replaced.
• Store it as a server secret (environment variable, secrets vault). Never in website or app code, where anyone can read it.
• The panel shows when each key was last used. A key that has not been used for a long time is a candidate for revoking.

Replace without taking the integration down#

Use Rotate on the key's row. EduPay creates a new key, with the same name and the same permissions, and the old one keeps working for 24 hours. During that window:

1. replace the key in the integrated system's configuration;
2. check that calls keep working (GET /me shows the name and the beginning of the key in use);
3. done: after 24 hours the old key stops on its own.

If the key leaked, don't wait the 24 hours: rotate it and then revoke the old one.

Revoke#

Revoke turns the key off immediately, including a key that is in its 24-hour overlap after a rotation. Integrations that use the key start getting 401.

Authentication responses#

The Moodle plugin keys are created on the same screen, with the Moodle bundles. They keep working as always, with the public API on or off. See Moodle integration.