Security & Authentication

How to handle Security and Authentication.

Important Most Learnosity services require hashing of certain attributes to prevent tampering with the intended context. This article details this approach so you can replicate it in your code. However for ease of use we provide helper SDKs in several languages and strongly recommend their use.

The SDK is available in PHP, Java, ASP.Net or Python. You can add one of these to your codebase and get going quickly by following the readme and examples in each SDK.





A valid signature is required to authenticate each Items API request, and is one of the required parameters of the Items JSON Object.

The signature is a 64 character long string, resulting from applying the SHA256 hashing algorithm to the concatenation of the following parameters in order, separated by underscores ('_'):

  1. consumer_key
  2. domain
  3. timestamp
  4. consumer_secret
The domain is the name of the host of the API's client. The server will check the requests come from one of the authorised domains for the client. This will need to match location.hostname of the client system.

The consumer_secret is a secret key supplied by Learnosity, known only by the client and Learnosity. The consumer_secret must not be exposed either by sending it to the browser or across the network.
    $security = array(
        "consumer_key"    => "INSERT_CONSUMER_KEY_HERE",
        "domain"          => "",
        "timestamp"       => gmdate('Ymd-Hi'),

    $consumer_secret = 'INSERT_CONSUMER_SECRET_HERE';
To create the string, a simple concatenation needs to performed, in the order specified above, along with the json representation of the request object.
    $request = array(
        "mode" => "item_edit",
        "reference" => "myItemRef",
        "user" => array(
            "id" => "walterwhite"

    $signatureArray = array_merge(array(), $security);

    array_push($signatureArray, $consumer_secret);
    array_push($signatureArray, json_encode($request));

    $preHashString = implode("_", $signatureArray);

    output will be:

The SHA256 algorithm is then applied to the concatenated string creating the signature

Further examples, as well as examples in other languages, can be found in the source code for our Demos page.

    $security['signature'] = hash('sha256', $preHashString);
    output will be a hash, eg:

    $initOptions = array(
        "security" => $security,
        "request" => $request


    <div id="learnosity-author"></div>
    <script src="//"></script>

    var initOptions = <?php echo(json_encode($initOptions));?>;

    var authorApp = LearnosityAuthor.init(initOptions);