Authentication

Audience: developers building an integration against the Master Teacher platform.

The eLearn Partner API uses OAuth 2.0 client credentials. Your integration authenticates as an application, not as a user — there’s no sign-in, no user token, and no consent screen. You exchange a client ID and secret for a short-lived access token, then send that token with each request.

What you’ll be issued

Master Teacher provisions the integration and gives you three things:

• Platform host — the base URL to call (not this help site’s domain).
• Client ID — public identifier for your application.
• Client secret — treat as a password.

The same provisioning step fixes which organizations and assessments your integration can read. See How access is scoped.

Requesting an access token

POST /oauth/token with grant_type=client_credentials.

Credentials may be sent as form parameters, as HTTP Basic auth, or in a JSON body — all three are accepted, so use whichever your HTTP client handles more cleanly.

As form parameters:

curl -X POST https://api.masterteacher.net/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET

As HTTP Basic auth:

curl -X POST https://api.masterteacher.net/oauth/token \
  -u YOUR_CLIENT_ID:YOUR_CLIENT_SECRET \
  -d grant_type=client_credentials

As a JSON body:

curl -X POST https://api.masterteacher.net/oauth/token \
  -H "Content-Type: application/json" \
  -d '{"grant_type": "client_credentials", "client_id": "YOUR_CLIENT_ID", "client_secret": "YOUR_CLIENT_SECRET"}'

A successful response:

{
  "access_token": "a1b2c3d4e5f6...",
  "token_type": "Bearer",
  "expires_in": 7200,
  "created_at": 1785312000
}

No scope parameter is needed. The API doesn’t use scopes — what a token can reach is determined entirely by the integration behind it.

Token lifetime

Access tokens are valid for two hours (expires_in is 7200 seconds). When a token expires, request another one the same way.

For a long-running export job, the simplest reliable pattern is to request a token at the start of the run, and request a fresh one if a request comes back 401 mid-run. Don’t cache a token beyond its lifetime, and don’t request a new token for every call — that’s needless load on the token endpoint.

Using the token

Send it as a bearer token on every API request:

curl https://api.masterteacher.net/api/v1/ax/assessments \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Errors

Status	When	Response
401	Wrong client ID or secret at the token endpoint	{"error":"invalid_client"}
400	Missing or unsupported grant_type	{"error":"unsupported_grant_type"}
401	Missing, malformed, or expired token on an API request	{"error":"invalid_token","error_description":"The access token is invalid"}
400	Token is valid, but the integration has no organizations assigned	{"errors":[{"message":"Invalid or missing tenant ids."}]}
400	Token is valid, but the integration has no assessments assigned	{"errors":[{"message":"Invalid or missing product ids."}]}

The last two indicate a provisioning problem rather than anything wrong with your request — the credentials worked, but the integration behind them has nothing attached. Contact Master Teacher support at support@masterteacher.com; retrying won’t help.

Keeping credentials safe

• Client credentials grant access to educator PII across every organization in your integration’s scope. Keep them server-side only — never in a browser, mobile app, or committed to source control.
• Store the secret in your platform’s secret manager or environment configuration, not in a config file that travels with the code.
• If a secret is exposed, contact support@masterteacher.com to have it rotated. Rotation invalidates tokens issued under the old secret.