API Keys
API Keys
Section titled “API Keys”Learnomy supports API keys for REST access. There is no API Keys screen in wp-admin – the standalone settings section was removed in Learnomy 1.5.0 – but the feature itself ships and is managed over the REST API.
What changed in 1.5.0
Section titled “What changed in 1.5.0”Learnomy 1.5.0 removed the API Keys section from LMS Settings (along with its sidebar item). It was gated behind a feature flag and never reached general availability as a screen. Only the admin UI was retired; the authentication method was not.
The four ways to authenticate
Section titled “The four ways to authenticate”Learnomy’s REST API accepts four kinds of credential. The first one that resolves a user wins, and an already-authenticated session is never overridden (includes/api/class-api-key-auth.php:28-56):
| Method | Use it for | How it travels |
|---|---|---|
| Cookie + nonce | Same-site requests from your own theme or admin screens | WordPress session |
| Application Passwords | The Learnomy companion mobile app | Standard WordPress Basic auth |
| API key | Server-to-server integrations and scripts | X-API-Key header |
| JWT | Headless front ends and custom integrations | Authorization: Bearer <token> |
Application Passwords are WordPress core, so nothing in Learnomy needs enabling for the app to sign in.
Managing API keys
Section titled “Managing API keys”Keys are created, listed and revoked over REST by any logged-in user, for their own account:
- Create –
POST /wp-json/learnomy/v1/auth/api-keys. The plaintext key is returned once, at creation. Store it then; it is not retrievable later. - List –
GET /wp-json/learnomy/v1/auth/api-keys. Returns metadata only, never the key itself. - Revoke –
DELETE /wp-json/learnomy/v1/auth/api-keys/{key_id}, wherekey_idis the UUID from the list call.
Keys are stored against the owning user in wp_usermeta, not in a dedicated table.
Using an API key
Section titled “Using an API key”Send it in the X-API-Key header:
curl https://example.com/wp-json/learnomy/v1/courses \ -H "X-API-Key: <your-key>"The header is the only accepted transport. A key passed as a query parameter is ignored (includes/api/class-api-key-auth.php:61-72), which keeps keys out of server access logs and browser history.
An API key acts as the user who created it and carries exactly that user’s permissions. It is not a privileged or site-wide credential. Revoke a key the moment it leaks, and issue a fresh one.
When to use which
Section titled “When to use which”- The companion mobile app, or anything acting as a real member: Application Passwords.
- A cron job, a reporting script, or another server calling in as one fixed account: API key.
- A headless front end that signs users in and needs short-lived, refreshable credentials: JWT (15-minute access token, 30-day refresh).