School-owned credentials
An Athletic Director or Booster Club administrator creates the Zeffy organization and campaigns, generates an API key, and verifies it during onboarding. The API key is encrypted on the server and scoped to that school. Each school has a unique webhook route and campaign mapping.