Authentication

The e-LearningCourses API uses the OAuth 2.0 client credentials flow for server-to-server integrations. First, create an API client for the organization or group the integration may access.

Request an access token

Send a form-encoded POST request to:

https://courses.e-learningcourses.com/connect/token

Include these fields:

Field	Value
grant_type	client_credentials
client_id	Your client ID
client_secret	Your client secret
scope	training.read for read APIs, assignments.write for assignments, or both separated by a space

This example requests a token for the read APIs:

curl --request POST \
  --url "https://courses.e-learningcourses.com/connect/token" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=$CLIENT_ID" \
  --data-urlencode "client_secret=$CLIENT_SECRET" \
  --data-urlencode "scope=training.read"

To assign learners, request assignments.write instead. The API client must have Assign Users enabled in API Access. To use one token for both reading and assigning, request training.read assignments.write.

{
  "token_type": "Bearer",
  "access_token": "ACCESS_TOKEN",
  "expires_in": 3600
}

Access tokens expire after 60 minutes. Reuse a token until shortly before it expires.

OAuth errors contain error and error_description fields.

Use the access token

Send the token in the Authorization header of each API request:

Authorization: Bearer ACCESS_TOKEN

Each API reference identifies its required scope.

Protect credentials

Keep client secrets and access tokens on a trusted server. Do not place them in browser JavaScript, mobile applications, source code, email, spreadsheets, or application logs.

Regenerating or revoking a client immediately revokes its existing access tokens.

Rate limits

Request	Limit
Access tokens	5 per minute per source IP address
Authenticated API requests	20 per minute per API client
Assignment requests	2 per minute per API client

The authenticated limit is shared across the read endpoints used by a client; assignments have a separate limit. Requests are not queued when a limit is reached. Retry 429 and transient 5xx responses with exponential backoff and jitter. For assignment batches, inspect per-learner results and retry only failures.