Skip to main content
POST
Get an access token
An access token is a temporary key that proves a request comes from your account. Every API request needs one. Get it by sending your API username and password as form data to POST /token. To get credentials, contact CrazyGoldFish.

Send the token

Add the token to the Authorization header of every other request:
Keep credentials and tokens on your server. Don’t put them in browser or mobile app code.

When a token expires

Tokens expire. The expiry time is the token’s exp claim, a Unix timestamp. Reuse a token until it expires instead of requesting one for every call. When a token is expired or invalid, the response depends on the API family: Request a new token and retry.

Use one API user per integration

A token identifies an API user, and some data is scoped to that user:
  • Webhooks only fire for jobs started by the user who registered them.
  • List worksheets only returns worksheets that user created.
  • Exam, assignment, and rubric lists only return items that user created.
Use the same API user for every call in one integration.

Body

application/x-www-form-urlencoded
username
string
required

Your API username, provided by CrazyGoldFish.

password
string<password>
required

Your API password.

Response

The token was issued.

access_token
string

A JWT. Its exp claim is the expiry time.

token_type
enum<string>
Available options:
bearer