How do I give a tool or assistant read access with an API token?

From the School Administrator manual, "API Tokens".

Senior and Junior Admins. This section appears only when Flux has turned on API access for your school; if you do not see it, ask Flux support.

An API token lets an outside system or an AI assistant read some of your school's information without anyone sharing a password. You find them on Manage Access: when API access is on for your school, two tabs appear at the top, People and API tokens. Choose API tokens. Your school's ID, which some API addresses need, is shown there with a Copy button.

What a token can and cannot do. A token works for your school only. It can do only the things you tick, and it stops working on its expiry date. No token can manage people or access, change school settings, delete data, or create other tokens.

Creating one. Choose + Create token and follow four steps:

1. What is this for? Build my own integration, Give an AI agent access, Share with a service, or Feed a spreadsheet (Excel or Google Sheets, read-only student names and grades; remember a spreadsheet is a copy of student information, so keep it private). This only chooses sensible starting ticks and expiry.
2. Name and expiry. Give it a name you will recognise, and optionally a note about who uses it. Choose 30, 90, 180 or 365 days. AI agents default to 30 days.
3. Permissions. Tick what it may read. Items marked Sensitive (student details, children's photos, home map pins, classes with student names) can only be granted by a Senior Admin; a Junior Admin sees them greyed out. You can also limit the token to certain internet addresses.
4. Review, then Create token.

What "Notices" means for a token. A token with the Notices permission can read your school's whole-school notices that are still current. It never sees a notice aimed at a particular class, grade or group, and personalised names in a notice stay as placeholders. The Documents permission works the same way: your school-wide documents (including the School Details page) and links to their attachments, never a document aimed at a particular class or grade. The Classes permission shows each active class's description, subject, room, term dates and staff, its meetings, and its roster when that class shares its roster with the whole school. It can also answer "it is 10:15, what is happening in Room 12?", and give one room's whole day for a sign outside the classroom. The Students permission includes each student's details (their home address only where the family chooses to show it); the separate Student photos permission gives a short-lived link to one student's photo, never photos in bulk.

Copy it now. The token appears once. Copy it, store it somewhere safe such as a password manager, tick the box and choose Done. Flux cannot show it again; if you lose it, revoke it and make a new one. Treat it like a password and never paste it into chat, email or a public site.

Seeing your tokens. Each token shows its name, kind, first and last few characters, what it can read, when it expires, and when it was last used. Use the Active, Expiring soon and Revoked or expired filters, and Details for permissions, allowed addresses and where it was last used from.

Rotating, suspending and limiting where a token can be used. From a token's card:

• Rotate... makes a new secret (shown once) and keeps the old one working for 24 hours, so you can switch whatever uses it without a gap. Permissions and expiry do not change. The token's owner or a Senior Admin can rotate it. Sandbox tokens cannot be rotated.
• Suspend stops a token immediately and can be undone with Resume. Any Senior or Junior Admin can suspend, so a misbehaving token can be paused without finding a Senior Admin. A suspended token shows the reason if one was given.
• Only from (in Details): list the internet addresses the token may be used from, such as the vendor's published ranges. Leave it blank to allow any address.

Revoking. Choose Revoke..., then Continue, then type the token's exact name and choose Revoke token. Anything using it stops immediately, and it cannot be restored.

Unusual activity. Each day the system looks at how every token was used. If a token was refused many times for permissions it does not have, hit its request limit many times, or made far more requests than usual, the token's owner and the school's Senior Admins get an email and an in-app notice. Nothing is suspended for you: open the token and choose Suspend (you can resume it later) or Revoke....

Owners and reminders. The admin who creates a token owns it and is emailed at 14 and 3 days before it expires. If the owner leaves the school the token keeps working and moves to a Senior Admin, who is told. Senior Admins are also notified whenever a token is created or revoked.

Source: a direct review of app/app/(app)/** routes and their components, as of 2026-08-11. Update this manual any time an admin-facing page, button, or workflow changes.