Docs · Onboarding
Getting started
A short walkthrough for the first administrator on a freshly provisioned Chalk tenant. If you're evaluating Chalk before signup, the features page is a better starting point.
Steps 1–5 and 8 apply to every tenant, including the free hosted tier — connecting your SIS is how Chalk learns your roster in the first place. Steps 6 and 7 hand that roster back out, through the OneRoster API and SAML SSO, and those are the Full stack tier if we host you — or included at no cost if you self-host. Both are marked.
You just clicked the verification email — now what?
Clicking the verification link finalizes your tenant. You land on the admin console at your tenant subdomain (e.g. yourdistrict.usechalk.xyz). The link is single-use; if it expires, request a new one from the sign-in page.
Set your admin password
The first thing the console asks for is a password for your administrator account. We use Argon2id with sensible defaults — pick something memorable but strong. You can enable SAML SSO later (step 7) and stop using a local password entirely.
Tour the admin dashboard
The dashboard shows tenant health at a glance: last sync, user counts, recent audit events. The left nav is grouped by job — Sync, Users, Google Sync, Identity, SSO Partners, Webhooks, Settings — with audit log and API tokens under Tools.
Configure your first SIS sync
From Sync → Connectors, choose your SIS. Chalk ships with first-class connectors for PowerSchool, Skyward, Infinite Campus, and any OneRoster CSV source. Each connector asks for the credentials specific to that SIS (OAuth client/secret, base URL, plugin keys).
- PowerSchool: client ID + secret from the PowerSchool plugin admin.
- Skyward: OneRoster credentials issued by your Skyward representative.
- Infinite Campus: OAuth credentials configured in Campus System Administration.
- OneRoster CSV: upload a ZIP of the standard OneRoster files (or point at an SFTP path).
Trigger your first sync
After saving credentials, hit Run sync. The console streams progress in real time and writes a full report to the audit log. Most first syncs take 1–10 minutes depending on district size. Subsequent syncs are scheduled per the cadence you configure under Sync → Schedule.
Generate an API token
Settings → API tokens lets you mint bearer tokens for downstream apps that want to read the OneRoster API. Tokens are shown once and stored hashed — copy the value into your secret manager immediately.
Availability: Full stack tier, or any self-hosted install. Connecting your SIS is included on every tier; serving that roster outward to other systems is not. See pricing →
Set up SAML SSO (optional)
Under Identity → SAML, Chalk can be either an IdP (issuing SAML assertions to your downstream apps) or a service provider (federating admin login to your district IdP). The SP-side setup steps — metadata URL, entity ID, attribute mapping — live in the repo README.
Availability: Full stack tier, or any self-hosted install. Connecting your SIS is included on every tier; serving that roster outward to other systems is not. See pricing →
When to contact support
If a sync fails with an opaque error, a downstream app rejects a credential, or you hit a security concern, reach out. Include the tenant slug and the audit-log timestamp so we can find your trace quickly.
What's next?
- · OneRoster API reference — for downstream apps that want to read your roster.
- · Security posture — what to send your IT security review.
- · Open the admin console — enter your workspace slug and we'll send you to your tenant.
- · Source on GitHub