API Keys & Integrations

An API key lets another system talk to Skoolyte for your school. Common uses:

• Your school website: the admission form sends inquiries straight into Admissions, and the website shows your announcements and events.
• An LMS, transport or attendance system: it reads your students and classes so you don't type them in twice.
• A bank or payment portal: it looks up a student's unpaid fees by admission number.

Each key can only do what you tick when you create it. A key can never change fees, take payments, or see CNIC, address, phone or medical details.

Go to Settings → API Keys and press Create key.

1. Give it a name you will recognise later, such as "School website".
2. Tick only what this key needs (see the permissions list below).
3. If you have more than one campus, you can limit it to one Campus. It will then only see that campus's students, classes and fees.
4. Optionally set an Expires date.

Press Create key. The full key (starting sk_live_) is shown once. Copy it and send it to your developer in a safe way. Skoolyte cannot show it again. If it is lost, revoke it and create a new one.

Only school admins can create or revoke keys.

• Send admission inquiries: add inquiries to Admissions. They show with the source website-api.
• Open classes: see which classes are currently open for admission (set under Admissions → Cycles).
• News & events: read announcements addressed to everyone and calendar events marked public. Staff-only announcements are never shared.
• Students & classes: read students' names, father's name, admission and roll numbers, gender, date of birth, class and status, plus your classes and sections.
• Fee dues: read a student's unpaid fees and total due by admission number. It cannot record payments.

On Settings → API Keys, press Revoke next to the key. It stops working immediately and cannot be switched back on. Create a new key if you need one. Revoke a key if a developer leaves, a website is replaced, or you think the key has been seen by someone else.

Each key shows when it was last used. A key that has never been used, or not for months, is safe to revoke.

• A key only sees your school, and only one campus if you limited it.
• Keys are secret, like a password. They belong on your website's server, never in web page code that visitors can open.
• Skoolyte stores only a fingerprint of the key, not the key itself.
• Creating or revoking a key, and every inquiry sent through a key, is recorded in Settings → Audit Logs.

Base URL: https://api.skoolyte.com/v1/integrations

Send the key with every request, in either header:

X-Api-Key: sk_live_…
Authorization: Bearer sk_live_…

All responses are JSON. Call the API from a server, not from browser JavaScript: the key would be visible to anyone, and browsers will block the cross-site request anyway.

The full interactive reference (every field, try-it-out) is at https://api.skoolyte.com/v1/integrations/docs. It asks for a key before it shows anything.

Lists come back as { "data": [...] }. The student list also has page, limit and total.

A PHP form handler that forwards the form to Skoolyte. Keep the key in a server setting, not in the page:

$payload = json_encode([
  'fullName'    => $_POST['child_name'],
  'parentName'  => $_POST['parent_name'],
  'parentPhone' => $_POST['phone'],
  'notes'       => $_POST['message'] ?? null,
]);
$ch = curl_init('https://api.skoolyte.com/v1/integrations/admissions/inquiries');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_POSTFIELDS => $payload,
  CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-Api-Key: ' . getenv('SKOOLYTE_API_KEY')],
  CURLOPT_RETURNTRANSFER => true,
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// 201 = received; 400 = check the fields (the message says which)

The same in Node.js:

const res = await fetch('https://api.skoolyte.com/v1/integrations/announcements', {
  headers: { 'X-Api-Key': process.env.SKOOLYTE_API_KEY },
});
const { data } = await res.json();

• 400: the request is not valid, for example a missing field, a bad phone number, or a class that is not open for admission. The message says what is wrong.
• 401: the key is missing, wrong, expired or revoked.
• 403: the key exists but does not have the permission this endpoint needs. Ask the school to create a key with it.
• 404: no student with that admission number (or not in the key's campus).
• 429: too many requests (about 100 a minute; inquiries 30 a minute). Wait a minute and retry. Cache announcements and events rather than fetching them on every page view.