Skip to main content
IQ Earners logo

Fast Launch

Opening IQ Earners

Loading only the essentials first.

FastSecureMobile
← Support centerIQ Earners

Organizations & integrations

API keys & integration guide

External schools and companies do not use the platform admin dashboard. Organization owners and admins manage API keys from the organization portal after signing in. Platform operators still use the internal admin console for global settings and cross-tenant webhooks.

Need access or integration help? Email iqearnersteam@gmail.com or use the actions below (no sponsorship forms on this page).

Request organization accessContact for API integration
Organization setup helpFAQPrivacy PolicyReplace {slug} and {portal-code} with values from your admin (e.g. slug acme-academy)

Path A — Organization admins (recommended)

  1. Open your organization login URL: https://<your-domain>/org/<slug>/portal/<portal-code>/login
  2. Sign in with an account that has the owner or admin role.
  3. Go to the owner dashboard → API keys tab (/org/<slug>/dashboard).
  4. Create a key, pick permissions, set a rate limit, and copy the secret once (it is not shown again).
  5. Enable or disable keys from the same screen; actions are recorded in the org audit trail.

Path B — IQ Earners platform staff

Internal operators use the admin workspace for cross-tenant keys, webhooks, and global configuration. This area is not exposed to external organizations.

Admin dashboard (staff only)

How org integrations work today

Login URLs include a per-organization portal code in the path. The login API expects portalCode in the JSON body together with username and password.

Live org data is accessed through /api/org/{slug}/… routes. After org login, the browser (or your server) holds an httpOnly session cookie. Use credentials: "include" in fetch or equivalent in your HTTP client.

API keys you create in the org dashboard are stored as organization-scoped secrets and are intended for server-to-server Bearer authentication (for example a future or partner-enabled /api/v1 surface). Until that surface is enabled for your tenant, prefer the org session + /api/org/… pattern from your backend.

Bearer authentication (API keys)

When calling Bearer-protected endpoints, send:

Authorization: Bearer iq_live_xxxxxxxxxxxxxxxx

Keys are generated with the iq_live_ prefix. Store them only in environment variables on your server.

Quick install samples

Node.js — org session (server)

// After obtaining session cookie from your login flow:
const res = await fetch(`${BASE}/api/org/${SLUG}/quizzes`, {
  headers: { Cookie: orgSessionCookie },
});
const data = await res.json();

Node.js — Bearer (when enabled)

const res = await fetch(`${BASE}/api/v1/quizzes`, {
  headers: { Authorization: `Bearer ${process.env.IQE_API_KEY}` },
});
const data = await res.json();

Example only: use a server-side env var (never NEXT_PUBLIC_*); the snippet above is static text, not executed in the browser.

Organization REST routes (reference)

Replace {slug} with your organization slug. Most routes require an org session cookie and the right role.

GET
/api/org/{slug}/info

Public org branding (no auth)

POST
/api/org/{slug}/auth

Org member login (sets httpOnly session cookie)

DELETE
/api/org/{slug}/auth

Sign out org session

GET
/api/org/{slug}/auth

Current org session

GET
/api/org/{slug}/members

List members (owner/admin)

POST
/api/org/{slug}/members

Add member (owner/admin)

GET
/api/org/{slug}/quizzes

List quizzes (role-filtered)

POST
/api/org/{slug}/quizzes

Create quiz (owner/admin/teacher)

POST
/api/org/{slug}/quizzes/import

Import quiz (JSON/PDF)

GET
/api/org/{slug}/quizzes/{quizId}

Quiz detail / take flow

PATCH
/api/org/{slug}/quizzes/{quizId}

Publish/archive (owner/admin/teacher)

GET
/api/org/{slug}/leaderboard

Org leaderboard

GET
/api/org/{slug}/analytics

Analytics (owner/admin/teacher)

GET
/api/org/{slug}/notifications

Notifications (owner/admin/teacher)

GET
/api/org/{slug}/audit

Audit log (owner/admin/teacher)

GET
/api/org/{slug}/integrity

Integrity events

POST
/api/org/{slug}/integrity

Report integrity event

GET
/api/org/{slug}/api-keys

List org API keys (owner/admin)

POST
/api/org/{slug}/api-keys

Create org API key (owner/admin)

PATCH
/api/org/{slug}/api-keys/{keyId}

Enable/disable key (owner/admin)

Webhooks

Outbound webhooks are configured from the platform admin workspace today (cross-tenant). If you need org-specific webhook delivery or signing secrets, request it from iqearnersteam@gmail.com so routing and security match your contract.

quiz.completedquiz.createduser.registereduser.scoredpayment.receivedtournament.startedtournament.endedcertificate.issuedleaderboard.updated
POST https://your-org-domain.com/webhooks/iqe
Content-Type: application/json

{ "event": "quiz.completed", "data": { }, "timestamp": "..." }

Security checklist

  • Never expose API keys or org passwords in frontend bundles or public repos.
  • Use one key per integration (LMS, ERP, internal cron) so you can revoke independently.
  • Grant the minimum permissions that integration actually needs.
  • Rotate keys periodically; disable keys immediately when a vendor contract ends.
  • Prefer server-side calls; if you proxy from your LMS backend, validate your own users first.