Security
Authentication & Sessions
Cookies, paid-user gates, attempt tokens, and organization API keys.
Consumer accounts authenticate via login flows that set uid, sid, username, and paid cookies. Protected quiz routes call requirePaidUser() and validate active sessions.
GET
/api/bootstrapSession snapshot: username, paid, entryFee, enrollments, layout
Auth: Optional cookie
POST
/api/user/loginUsername/password login
Auth: Public
POST
/api/user/logoutClear session cookies
Auth: Cookie
GET
/api/user/session/validateValidate active device session
Auth: Cookie
Tournament and daily quiz submissions require a short-lived attempt token issued when the user starts a quiz.
// POST /api/quiz/start → { ok, quizId, code, attemptToken, attemptTokenExp }
// POST /api/user/stats → include attemptToken in body when quizId is setAttempt tokens bind to username + quizId + nonce. Replaying tokens or skipping start will return 403.
Organization portals use /api/org/{slug}/auth with portalCode in the JSON body. API keys use the iq_live_ prefix in the Authorization header.