Security
Authentication & Sessions
Cookies, paid-user gates, attempt tokens, and organization API keys.
Consumer accounts authenticate through the standard login flow, which sets secure session cookies. Protected quiz routes require an active paid membership.
Private application endpoints are intentionally omitted from public documentation. Contact support for approved partner access.
Tournament and daily quiz submissions require a short-lived attempt token issued when the user starts a quiz.
// POST /api/quiz/start → { ok, quizId, code, attemptToken, attemptTokenExp }
// POST /api/user/stats → include attemptToken in body when quizId is setAttempt tokens bind to username + quizId + nonce. Replaying tokens or skipping start will return 403.
Organization portals use /api/org/{slug}/auth with your portal code in the JSON body. Server integrations should send API keys in the Authorization: Bearer header.