Quickstart: create an API key and make your first call

Steps

1. 1
   Sign in as a person whose role has the integration write permission. Owner and admin roles have it by default. Open Developer in the Integrations section of the app menu. This opens the Developer console at /integrations/developer.
2. 2
   Open the API keys tab and select Create API key. The button only appears if your role can write integrations.
3. 3
   In the Create API key dialog, enter a Label, choose API key under Kind, and tick the Scopes you need, for example students:read. Select Create key. The button stays disabled until you add a label and at least one scope.
4. 4
   In the API key created dialog, select Copy to clipboard, store the secret safely, then select Done. The full secret is shown once and cannot be retrieved later. API keys start with ck_live_.
5. 5
   Send requests to your ChessCore app address followed by /api/v1, with the header Authorization: Bearer <your key>. For example, GET /api/v1/students returns { data: [...], page: { next_cursor } }.
6. 6
   To add a student, send POST /api/v1/students with an Idempotency-Key header and a JSON body with full_name (1 to 200 characters), an optional valid email, and an optional grade (up to 50 characters). This needs the students:write scope and returns 201 with the new student.
7. 7
   To add a note to a student, send POST /api/v1/students/{id}/notes with an Idempotency-Key header and a body of { "body": "..." } (1 to 10000 characters). This needs students:write and returns 201.
8. 8
   To find students by exact email, send GET /api/v1/students?email=<address>. It returns up to 25 matches and no cursor.
9. 9
   The OpenAPI description is public at GET /api/v1/openapi.json and needs no credential.

Related guides

• Authentication and scopesHow the /v1 API checks a Bearer credential, the two key types, and the scope each route needs.
• Idempotency keysEvery write needs an Idempotency-Key header so a retried request never runs twice.
• Errors and request IDsThe shared error shape, every error type with its HTTP status, and the X-Request-Id header.