Authentication

The Student Data API uses a two-layer authentication model. Both credentials must be included in every data request.

API Key (x-api-key)

The API key identifies your vendor account and enforces rate limits. Include it as a request header:

x-api-key: sk_live_abc123def456...

The API key is not a secret for authorization — it controls throttling and usage tracking. However, keep it confidential to prevent others from consuming your rate limit quota. The API key is required on all requests, including the login endpoint.

Bearer Token (Authorization)

The Bearer token is a Permission JWT (PJWT) that defines your authorized data access scope — which districts and schools you can query. Include it as a standard Bearer token:

Authorization: Bearer eyJhbGciOiJIUzUxMiI...

Vendors obtain a PJWT by calling the Login Endpoint (POST /v1/login) with their Triand account email and password. The token is valid for 24 hours and must be refreshed by calling login again.

The PJWT encodes:

• Your vendor identity
• Authorized district IDs
• Authorized school IDs
• Permission flags

You cannot modify the PJWT to expand your access scope. If you need access to additional districts or schools, contact your administrator.

Authentication Flow

1. Call POST /v1/login with your email, password, and x-api-key to receive a PJWT
2. Cache the PJWT token (valid for 24 hours)
3. Include both x-api-key and Authorization: Bearer {pjwt} on all data requests
4. When the token expires (401 response), call login again to get a fresh token

Example Request

POST https://api.triand.com/v1/students
Content-Type: application/json
x-api-key: sk_live_abc123def456...
Authorization: Bearer eyJhbGciOiJIUzUxMiI...

{
  "limit": 25,
  "districtlea": "1503000"
}

Authentication Errors

If authentication fails, the API returns one of these responses:

Token Rotation

If your API key is compromised, contact your administrator to rotate it. A new key will be issued and the old one deactivated. Your Bearer token (PJWT) will be regenerated if your access scope changes — simply call login again to get the updated token.