Authentication

Overview

Every SchoolScout API endpoint requires authentication.

For external integrations, use an API key created in the dashboard UI.

Create an API key in Settings > API Keys, then pass it as a Bearer token:

curl -H "Authorization: Bearer sk_live_your_key_here" \
  https://schoolscout.ai/api/v1/districts

For MCP clients and OAuth-based integrations, use an access token in the same header format:

curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  https://schoolscout.ai/api/v1/districts

The web app handles dashboard authentication automatically.
This is not intended as a programmatic API auth method.

API keys can be created, rotated, and revoked from Settings > API Keys.

If authentication fails, routes return:

{
  "error": "Unauthorized",
  "message": "You must be logged in"
}

with HTTP status 401.

Authentication resolves to your organization context.
Credits, unlocks, and visible data are scoped to that organization.

Some data is gated behind a credit system. Entities have an _access field in responses:

{
  "id": "...",
  "name": "Denver Public Schools",
  "_access": {
    "is_unlocked": false,
    "unlock_cost": 6
  }
}

Use the POST /api/v1/unlock endpoint to spend credits and unlock entity intelligence data. See Credits for details.