API keys and tenant binding

Use the API key screen available to your account or school to create and manage a key. Copy it at creation: the value is shown once. A key acts for its creator within one organization. Send it as x-api-key; do not send an organizationId to select a different school. A resource in another school is not exposed through the key.

Check the API quickstart for the current key creation and binding limitation before relying on a new key. Keep distinct keys for distinct schools or integrations, and rotate a lost key.

The API reference gives shared authentication, idempotency and error rules. API key management itself is a screen workflow.