Admin console

Operations

Schools -

Active -

Onboarding -

Attention -

Failed imports -

Schools

No schools loaded.

Search Status Health

School	Onboarding	Sync	Latest data	Staff

No schools match the current filters.

Select a school

The operational record will open here.

School

School

School console

Contract record

Save SLA, billing, and renewal reminder details for this school.

Legal school name DfE/URN/reference Trust/local authority Purchase order Billing contact Billing email Signatory name Signatory role Signatory email Agreement date Signed date Contract start Contract end Contract status Initial term months Notice period days Reminder lead days Annual fee GBP VAT status Student access method

School address Special terms

Name	Email	Access	Status	Action

No staff linked yet.

Core onboarding config

School name Short name MIS Wonde school ID Wonde token Attendance year start Launch date Lead email Holiday/closure ranges

Contract and SLA

Legal school name DfE/URN/reference Trust/local authority Purchase order Billing contact Billing email Signatory name Signatory role Signatory email Agreement date Signed date Contract start Contract end Contract status Initial term months Notice period days Reminder lead days Annual fee GBP VAT status Student access method

School address Special terms

Onboarding runbook

Select a school to review onboarding status.

Backfill start Backfill end Max days

Queueing is best for full school onboarding. The worker checks for queued jobs every 15 minutes, and this page refreshes every 60 seconds. Run now is useful for a small test or repair run.

Trial Schools

WMA Trial School

Loading trial access...

Show archived Open console

Slot	School	Contact	Activity	Actions

No trial access assigned yet.

Security & Access

Password setup and Turnstile

Operational notes for staff setup emails, password resets, and the Cloudflare Turnstile protection now active on the admin and school reset flows.

Open admin reset page

Turnstile Enabled

Setup/reset email requests must pass the Cloudflare security check before the API sends an email.

Protected page Admin reset

admin.whatsmyattendance.com/password-reset

Link validity 24 hours

Old links can still open the page, but they cannot be used after expiry or completion.

When adding school staff

Create the staff account from the selected school's Staff tab.
Keep Send setup email ticked for new accounts.
Tell the member of staff to check inbox and junk/spam.
If the link expires, use Resend setup from the Staff tab.

When a user requests their own link

User opens the Admin Console or School Console sign-in page.
User enters their email and selects Set or reset password.
The page redirects to the reset page and pre-fills their email.
User completes Turnstile, then requests a fresh setup email.

What Turnstile protects

Self-service setup/reset email requests on the public School Console.
WMA admin and school staff reset requests made from the reset page.
Automated/bot attempts to trigger repeated email sends.

What to check if a reset fails

Use the newest email only; older links may have expired or been superseded.
Confirm the account exists in Firebase Auth and is linked in portalUsers.
For normal schools, confirm an active school membership exists.
For WMA admin, confirm globalRole is wma_admin or canViewWmaAdmin is true.

Current production configuration

Cloudflare widget hostname: admin.whatsmyattendance.com and schools.whatsmyattendance.com
Frontend site key locations: admin-portal/config.js and school-portal/config.js
Secret storage: Google Secret Manager → wma-turnstile-secret-key
Cloud Run env: TURNSTILE_REQUIRED=true, TURNSTILE_EXPECTED_HOSTNAMES=admin.whatsmyattendance.com,schools.whatsmyattendance.com

Do not paste the Turnstile secret into frontend files or school-facing documents. Rotate the secret in Cloudflare if it is ever exposed.