API & delegate tokens

Minted in Agents & API. Raw tokens are shown once and stored hashed — treat them like passwords, revoke them any time.

API tokens (`atk_…`)

Full-scope by default, no expiry. For your own agents and scripts. Scopes can be narrowed at mint: bank:read, bank:write, tests:read, tests:write, results:read, results:write, send.

Delegate tokens (`adt_…`)

For someone else — a colleague, a typing service, or our team doing assisted entry. Defaults: question-bank scopes only, 7-day expiry, 500 requests. Minting one gives you a ready-to-forward message; the delegate (or their agent) uses it exactly like an API token, and:

• every question it adds is stamped with the token — you always know what came from whom;
• it cannot see results, publish tests, or email students;
• the first user binds it (X-Delegate-Email header identifies them); it stops at expiry, use-cap, or the moment you revoke it.

Too busy to type questions?

Mail your question paper to the address on your dashboard and our team will load it for you using exactly this mechanism — a 3-day delegate token minted against your account, every insertion attributable.