- Purpose
- Configure the separate protected administrator credential used when Studio activates provider scenarios.
- Prerequisites
- Administrator access to both applications
- Server-side secret storage
- Architecture
- Integration Studio represents the external client or LMS. API Exams App represents the assessment provider. Exam Player is the candidate-facing browser application.
Configuration
| Studio | Saved per Connection; raw password is server-only and sent only to protected API admin login |
| API Exams | Stores/verifies the hash; the raw password is not a browser setting |
| Purpose | Simulator scenario administration, separate from REST, candidate, webhook and LTI credentials |
Implementation steps
- 01Open Integration Studio → Connections → API Exams → Simulator Controls.
- 02Enter Admin Username and Admin Password / Secret. These are used only by the Studio server to control protected API Exams simulator scenarios.
- 03Click Save Simulator Controls and wait for the success notification. The saved Connection credential overrides the legacy environment fallback.
- 04API Exams continues to validate the same administrator through its protected /admin/login boundary and password hash.
- 05Use Provider Lab to activate a scenario. This performs a real server-side simulator-control request.
- 06If no Connection credential is saved, the backward-compatible Studio fallback is EXAMS_ADMIN_USERNAME and EXAMS_ADMIN_PASSWORD.
- 07Never use REST credentials for simulator controls. Never put this password in URLs, browser state, candidate fields, webhook fields or LTI registration.
Testing procedure
- Scenario activation succeeds
- No raw admin password appears in browser responses or logs
Troubleshooting
Simulator control error
Missing credentials means neither the Connection nor the configured fallback is available. Rejected credentials mean API Exams refused the supplied administrator. Check the username and matching API Exams password hash without printing the secret.