Getting started

Clicking the verification link finalizes your tenant. You land on the admin console at your tenant subdomain (e.g. yourdistrict.chalk.school). The link is single-use; if it expires, request a new one from the sign-in page.

<!-- TODO screenshot: verification landing page -->

The first thing the console asks for is a password for your administrator account. We use Argon2id with sensible defaults — pick something memorable but strong. You can enable SAML SSO later (step 7) and stop using a local password entirely.

<!-- TODO screenshot: set password screen -->

The dashboard shows tenant health at a glance: last sync, user counts, recent audit events. The left nav is grouped by job: Sync, Users, Identity, Marketplace, Settings.

<!-- TODO screenshot: dashboard overview -->

From Sync → Connectors, choose your SIS. Chalk ships with first-class connectors for PowerSchool, Skyward, Infinite Campus, and any OneRoster CSV source. Each connector asks for the credentials specific to that SIS (OAuth client/secret, base URL, plugin keys).

• PowerSchool: client ID + secret from the PowerSchool plugin admin.
• Skyward: OneRoster credentials issued by your Skyward representative.
• Infinite Campus: OAuth credentials configured in Campus System Administration.
• OneRoster CSV: upload a ZIP of the standard OneRoster files (or point at an SFTP path).

<!-- TODO screenshot: connector configuration form -->

After saving credentials, hit Run sync. The console streams progress in real time and writes a full report to the audit log. Most first syncs take 1–10 minutes depending on district size. Subsequent syncs are scheduled per the cadence you configure under Sync → Schedule.

<!-- TODO screenshot: sync run progress view -->

Settings → API tokens lets you mint bearer tokens for downstream apps that want to read the OneRoster API. Tokens are shown once and stored hashed — copy the value into your secret manager immediately.

<!-- TODO screenshot: api tokens list with generate button -->

Under Identity → SAML, Chalk can be either an IdP (issuing SAML assertions to your downstream apps) or a service provider (federating admin login to your district IdP). The SP-side setup steps — metadata URL, entity ID, attribute mapping — live in the repo README.

<!-- TODO screenshot: SAML configuration screen -->

If a sync fails with an opaque error, a downstream app rejects a credential, or you hit a security concern, reach out. Include the tenant slug and the audit-log timestamp so we can find your trace quickly.