Learnomy
Get Learnomy Pro

API Keys

Learnomy supports API keys for REST access. There is no API Keys screen in wp-admin -- the standalone settings section was removed in Learnomy 1.5.0 -- but the feature itself ships and is managed over the REST API.

What changed in 1.5.0

Learnomy 1.5.0 removed the API Keys section from Learnomy Settings (along with its sidebar item). It was gated behind a feature flag and never reached general availability as a screen. Only the admin UI was retired; the authentication method was not.

The four ways to authenticate

Learnomy's REST API accepts four kinds of credential. The first one that resolves a user wins, and an already-authenticated session is never overridden (includes/api/class-api-key-auth.php:28-56):

Method Use it for How it travels
Cookie + nonce Same-site requests from your own theme or admin screens WordPress session
Application Passwords The Learnomy companion mobile app Standard WordPress Basic auth
API key Server-to-server integrations and scripts X-API-Key header
JWT Headless front ends and custom integrations Authorization: Bearer <token>

Application Passwords are WordPress core, so nothing in Learnomy needs enabling for the app to sign in.

Managing API keys

Keys are created, listed and revoked over REST by any logged-in user, for their own account:

  1. Create -- POST /wp-json/learnomy/v1/auth/api-keys. The plaintext key is returned once, at creation. Store it then; it is not retrievable later.
  2. List -- GET /wp-json/learnomy/v1/auth/api-keys. Returns metadata only, never the key itself.
  3. Revoke -- DELETE /wp-json/learnomy/v1/auth/api-keys/{key_id}, where key_id is the UUID from the list call.

Keys are stored against the owning user in wp_usermeta, not in a dedicated table.

Using an API key

Send it in the X-API-Key header:

curl https://example.com/wp-json/learnomy/v1/courses \
  -H "X-API-Key: <your-key>"

The header is the only accepted transport. A key passed as a query parameter is ignored (includes/api/class-api-key-auth.php:61-72), which keeps keys out of server access logs and browser history.

An API key acts as the user who created it and carries exactly that user's permissions. It is not a privileged or site-wide credential. Revoke a key the moment it leaks, and issue a fresh one.

When to use which

  • The companion mobile app, or anything acting as a real member: Application Passwords.
  • A cron job, a reporting script, or another server calling in as one fixed account: API key.
  • A headless front end that signs users in and needs short-lived, refreshable credentials: JWT (15-minute access token, 30-day refresh).

Related