Getting Started

Authentication

The StudyHQ Partner API uses token-based authentication. Every API request must include a valid access token in the request header.

Access Tokens

Tokens are issued per project (college) during onboarding. Each token is a pair of credentials:

CredentialDescription
TokenIdPublic identifier for the token
TokenSecretSecret value used to authenticate — shown only once at creation

The TokenSecret is displayed only once when the token is created. Store it securely. If lost, the token must be regenerated.

Sending the Token

Include the token in every request using the X-Access-Token header, formatted as TokenId:TokenSecret:

$X-Access-Token: <TokenId>:<TokenSecret>

Required Headers

HeaderValue
X-Access-Token<TokenId>:<TokenSecret>
Content-Typeapplication/json
Acceptapplication/json

Example Request

$curl -X POST https://api.studyhq.com/partner/get-redirect-url \
>  -H "Content-Type: application/json" \
>  -H "X-Access-Token: tok_abc123:secret_xyz789" \
>  -d '{
>    "projectId": "L4ndb5PYxM",
>    "name": "Student name",
>    "email": "student@gmail.com",
>    "mobile": "9876543210"
>  }'

Token Lifecycle

EventBehavior
Token createdSecret is shown once — copy it immediately
Secret lostToken must be deleted and regenerated
Token revokedAll requests using that token will fail with 401
Token scopeRestricted to a single project (college)

Security Best Practices

  • Never expose the X-Access-Token header in client-side code or browser requests
  • Do not log raw request headers in your application
  • Rotate tokens periodically or immediately if compromised
  • Contact support@studyhq.com for token revocation or rotation assistance