GETTING STARTED

Authentication

The edu.games LRS uses HTTP Basic Authentication as specified by the xAPI standard. In-player and sandbox sessions instead receive a short-lived Bearer launch token (valid for 2 hours, bound to one game, registration and actor) via the injected launch context — if you use the SDK or echo the launch context’s auth value verbatim, both schemes just work. Basic key:secret is for server-to-server calls and local testing.

Your Credentials

When your game is approved, an xAPI key and secret are automatically generated. Find them in the developer portal under Plugins & SDKs → xAPI Credentials. Only a hash of the secret is stored, so the portal cannot show it to you: press Rotate Secret to mint a new one, which is displayed exactly once — copy it then. Rotating invalidates the previous secret immediately (running player sessions are unaffected, because they use launch tokens rather than the secret).

Keep your secret secure. Never expose credentials in client-side JavaScript that is publicly readable. Use environment variables or a server-side proxy.

Basic Auth Format

Encode your key and secret as base64(key:secret) and send it in the Authorization header.

javascript

const key = 'eg_abc123...';
const secret = 'def456...';
const token = btoa(`${key}:${secret}`);

// Use in all xAPI requests:
const headers = {
  'Authorization': `Basic ${token}`,
  'Content-Type': 'application/json',
  'X-Experience-API-Version': '1.0.3',
};

LRS Endpoint

plaintext

Base URL: https://lrs.edu.games/xapi

Endpoints:
  GET            /xapi/about                 LRS version (no auth required)
  POST           /xapi/statements            Submit one statement or a batch
  PUT            /xapi/statements?statementId=<uuid>   Store one statement with your own id
  GET            /xapi/statements            Query statements
  GET/PUT/DELETE /xapi/activities/state      Learner state documents
  GET/PUT/DELETE /xapi/activities/profile    Activity profile documents
  GET            /xapi/activities            Activity definition lookup
  GET            /xapi/agents                Agent (Person) lookup
  GET/PUT/DELETE /xapi/agents/profile        Agent profile documents

Per-endpoint request shapes are in the API Reference; per-minute limits in Rate Limits.

Testing Your Credentials

/xapi/about answers without checking the Authorization header, so it proves connectivity and the version, not your credential. To confirm the key and secret are accepted, query statements — a bad credential returns 401.

bash

# 1. Connectivity + version (no auth needed)
curl https://lrs.edu.games/xapi/about \
  -H "X-Experience-API-Version: 1.0.3"
# → {"version":["1.0.3"],"extensions":{}}

# 2. Credential check: an authenticated query (empty list is fine)
curl "https://lrs.edu.games/xapi/statements?limit=1" \
  -H "Authorization: Basic $(echo -n 'YOUR_KEY:YOUR_SECRET' | base64)" \
  -H "X-Experience-API-Version: 1.0.3"
# → 200 with {"statements":[...],...}   (401 Unauthorized if the key/secret is wrong)

← Review & Game Lifecycle Content Policy →