API tokens
Create and revoke the tokens that let a script or Pulumi program manage your school site.
Settings › API is for owners and admins. A token lets a script read your school's site configuration, or replace it, through the Aula management API at /api/v1. The OpenAPI document is served at /api/v1/openapi.json.
Create a token
Enter a name that says what the token is for, choose a scope and, if you want one, an expiry in days. Choose Create token.
- Read the site: can read the site configuration and the custom domain.
- Read and replace the site: can also replace the site configuration.
The secret starts with aula_ and is shown once. Copy it before leaving the page: Aula keeps only a fingerprint and cannot show it again. A token works for your school only.
Use a token
Send it as a bearer token:
curl -H "Authorization: Bearer aula_..." https://aula.sferarc.com/api/v1/site-configWith the Pulumi provider @sferarc/aula-pulumi, store it as the secret aula:token.
Revoke a token
Revoke stops a token at once. It stays in the list, greyed out, so you can see when it was revoked. Revoke a token as soon as you think it has leaked, then create another.