Skip to main content

​
API keys

Create Partner API keys in the admin portal under API Keys. Send the key as a bearer token on every request:
Keys come in two modes, distinguished by prefix: Both are fully functional; the prefix is only so your side can tell environments apart. Every key is scoped to your institution — every test you list and every assignment you create is automatically scoped to it.
The full key is shown only once, when you create it. Store it in your server-side secret store immediately. If you lose it, revoke it and create a new one — the original cannot be retrieved.
Server-to-server only. Never put an API key in browser JavaScript, a mobile app, or any client your users can inspect. Rotate immediately if a key is exposed — you can run two active keys at once during a rotation.

​
Callback domains

Before you can assign a test, allowlist the domain(s) your students return to after finishing. In the admin portal, under API Keys → Callback domains, add either:
  • an exact hostname — portal.example.com, or
  • a leading-dot wildcard — .example.com, which matches the domain and any subdomain.
At assignment time, the callbackUrl you provide must be HTTPS and its host must match an allowlisted entry, or the request is rejected with 403 forbidden. This protects both sides against open-redirect abuse.

​
Errors

Every error response uses the same envelope:
Include the requestId when contacting support — it points straight at the failed request.