Contents
API tokens - Plugixa Exam
A token lets a script, another system or a scheduled job use the REST API without a WordPress login.
Scopes, and default deny
A token carries thirteen separate scopes, and every one of them starts off. You grant exactly what the integration needs.
That ordering matters. A token that defaults to full access and is then narrowed is one forgotten checkbox away from being a master key; a token that defaults to nothing fails loudly during development instead.
Typical shapes:
| Integration | Scopes to grant |
|---|---|
| A reporting dashboard | read on attempts and reports |
| A bulk question importer | read and write on questions and subjects |
| A student-records sync | read on attempts only |
Using one
Send it as a bearer token:
Authorization: Bearer <token>
against the plugixa-exam/v1 namespace. See
REST API.
Handling
The token is shown once, when it is created. Store it where you store other secrets; if it is lost, revoke it and issue another rather than trying to recover it.
Revoking is immediate. Issue one token per integration, so revoking one does not take the others down with it.
Troubleshooting
| Symptom | Usual cause |
|---|---|
| 403 on a route the token should reach | The scope is not granted. They default to deny. |
| Reads work, writes do not | Read and write are separate scopes. |
| The token stopped working | It was revoked, or the API tokens capability was switched off. |
| A browser request fails the same way | Browsers use the cookie and nonce, not a token. Different path entirely. |
What to do next
- See what the endpoints look like in REST API.
- Have events pushed to you instead: Webhooks.
- Restrict who may issue tokens in Roles and Permissions.