Skip to main content
Every request you make to the VClasses API must include a Bearer token. The API validates this token on each call to confirm your identity and role. Along with your token, you must send an Accept: application/json header so the server returns machine-readable responses. Both headers are required for all authenticated endpoints.

​
Required Headers

Include the following two headers in every API request:
If you omit the Accept: application/json header, the server may return an HTML redirect (HTTP 302) instead of a structured JSON error response. This can make authentication failures difficult to detect and handle programmatically. Always include this header.

​
Admin vs. Student Tokens

VClasses uses role-based access control. The role is attached to your account at the time your token is issued — you do not need to specify it in the request itself.
  • Admin tokens grant access to all admin-scoped endpoints, such as managing homeworks, grades, and course settings.
  • Student tokens are required for student-scoped actions, such as submitting quiz answers and viewing personal results.
Both token types use the same Authorization: Bearer <your-token> header format. If you send a request to an endpoint that requires a different role than the one attached to your token, the API returns a 403 Forbidden error (see Authentication Errors below).
If you need to act in both an admin and a student capacity, use the token that corresponds to the role required by each specific endpoint.

​
Example: Authenticated Request

The following example retrieves the list of homeworks from an admin endpoint. Replace your-token-here with your actual token:

​
Authentication Errors

When authentication fails, the API returns one of the following HTTP error codes: If you receive a 401, verify that your token is correct and has not expired, and confirm that the Authorization header is present and formatted as Bearer <your-token>. If you receive a 403, confirm that you are using a token whose role matches the requirements of the endpoint you are calling.

​
Tips

Keep your Bearer token secret at all times. Never embed it in client-side code (such as a front-end JavaScript bundle), and never commit it to a public repository. If your token is exposed, revoke it immediately from your VClasses account settings and generate a new one. Consider using environment variables or a secrets manager to supply the token to your application at runtime.