> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kralis.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Developer Quickstart

> Onboard a school, authenticate, explore the schema, and make an authenticated Kralis API call.

## 1. Onboard and configure the school

Create the school at [kralis.app/onboard](https://kralis.app/onboard), then use [Kralis Web](https://kralis.app) to configure its current year and term, classes, sections, subjects, users, roles, and enabled modules.

```mermaid theme={null}
flowchart LR
    A[Onboard school] --> B[Configure school]
    B --> C[Authenticate account]
    C --> D[Call GraphQL]
    D --> E[Build client workflow]
```

## 2. Authenticate with GraphQL

Send `login` to `/graphql/`. The same operation can be explored interactively at `/graphiql/`.

```bash theme={null}
curl https://api.kralis.app/graphql/ \
  -H "Content-Type: application/json" \
  -d '{"query":"mutation Login($input: LoginInput!) { login(input: $input) { access refresh user { pk username fullName role } school { pk schoolName } } }","variables":{"input":{"username":"YOUR_USERNAME","password":"YOUR_PASSWORD"}}}'
```

Keep the returned access and refresh tokens private.

## 3. Call GraphQL

```bash theme={null}
curl https://api.kralis.app/graphql/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query":"query { userBroadCasts { pk title message } }"}'
```

Use [GraphiQL](https://api.kralis.app/graphiql/) to inspect current queries, mutations, inputs, filters, and return types. Its **Headers** panel accepts the same Bearer token.

## 4. Refresh when required

Call `refreshLoginToken` once after an access token expires. Store both newly returned tokens before retrying the original operation.

```mermaid theme={null}
sequenceDiagram
    participant U as School user
    participant C as Your client
    participant G as Kralis GraphQL API
    U->>C: Sign in
    C->>G: login
    G-->>C: Access + refresh + limited session context
    C->>G: Product operation with Bearer access token
    G-->>C: School-scoped result
    C->>G: refreshLoginToken when access expires
    G-->>C: Rotated access + refresh tokens
```

## Before production

| Check          | Expected outcome                                                          |
| -------------- | ------------------------------------------------------------------------- |
| Credentials    | No secret or token is committed to source control                         |
| Token storage  | Appropriate for a browser, server, or mobile threat model                 |
| Rotation       | Both tokens are replaced after every successful refresh                   |
| School scoping | The UI uses authenticated school context rather than arbitrary school IDs |
| Roles          | Unauthorized actions are hidden and API permission errors are handled     |
| Pagination     | Growing connections load beyond the first page                            |
| References     | Operations are generated or verified against the live schema              |

See [Authentication](/developers/authentication) and [API Access, Templates, and Support](/developers/access-and-support) before production rollout.