Inside the Tutor LMS REST API
Authentication
Tutor LMS generates API key and secret pairs per user from its settings, stores them in user meta, and accepts them as HTTP Basic credentials on its API routes. Each key has a permission level (read or read/write). Keys must be kept server-side, never in a mobile app bundle or browser code, and rotated if exposed.
Free and Pro endpoints
Free endpoints are read-only: /courses, /courses/{id}, /topics, /lessons, /quizzes, /quiz-attempt-details/{id}, /course-contents/{id} and others. Pro registers write endpoints such as /enrollments, /lesson-mark-complete, /course-mark-complete and /quiz-attempts, plus endpoints for students, profiles, Q&A, reviews and wishlists.
Custom endpoints
When an integration needs something the API does not offer, such as a report or a custom field, we register a route with register_rest_route, a strict permission callback and validated parameters, using Tutor LMS functions rather than raw SQL where possible. See our REST API guides.