API Authentication

​

General configuration

• Base URL: https://app.indolat.com/api/v1
• Authentication: Authorization: Bearer <API_KEY>
• Request/response format: application/json
• Default rate limit: 120 requests per minute per project; the active value is available from GET /me
• Default pagination: 25 items per page, up to 100
• Maximum batch operation: 500 participants per request

Authorization: Bearer <API_KEY>
Accept: application/json

Content-Type: application/json

​

Response format

{
  "success": true,
  "message": null,
  "data": {}
}

{
  "success": false,
  "message": "Data yang dikirim tidak valid.",
  "errors": {
    "email": ["Format alamat email tidak valid."]
  }
}

​

Validate the API key

curl -X GET "https://app.indolat.com/api/v1/me" \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Accept: application/json"

{
  "success": true,
  "message": null,
  "data": {
    "client": {
      "id": 3,
      "name": "SMA Nusantara",
      "code": "smanusantara",
      "app_url": "https://smanusantara.cbt.example.com"
    },
    "addons": {
      "api_integration": true,
      "registration_page": true,
      "exam_certificate": false,
      "custom_domain": false
    },
    "exam_credits": { "professional": 250, "free": 25 },
    "limits": {
      "rate_limit_per_minute": 120,
      "max_batch_rows": 500,
      "max_page_size": 100
    }
  }
}

​

Security notes

• Store the API key on your server only, never in a frontend or mobile app.
• Use the IP whitelist under Application Settings → API Integration whenever possible.
• Register only domains you own under Post-Exam Redirect Domains. Exam access links accept a return_url only on a registered domain and over https://.
• Regenerate the API key (Regenerate API Key) immediately if you suspect it has leaked; the old key stops working straight away.
• An exam access link acts as a participant login and can be used only once. Create the link when the participant is about to sign in, redirect the participant straight away, and keep the validity period as short as possible.
• Use HTTPS for webhook endpoints, and verify the signature against the raw request body before processing the payload.