Authentication

Use an API key to authenticate requests to the Form User API. Start with a verification request, then check the requirements and troubleshooting guidance below.

Authenticate a request

Send your key in the Authorization header. Use this exact header name for new integrations, even when using British English elsewhere.

Authorization: API_KEY

Replace API_KEY with your key. Send its value unchanged, without quotes or extra spaces. The public API reads keys from headers, not query parameters, cookies or request bodies.

For endpoints with a JSON request body, also send Content-Type: application/json. This describes the body format; it does not authenticate the request.

Keep keys in server-side configuration and out of source control. The public GET /ping and GET /status endpoints do not need a key.

Verify your API key

Send this request using your integration's API key:

curl --request GET 'https://euma.api.melearning.co.uk/api/whoiam' \
  --header 'Authorization: API_KEY'

A successful request returns the key and its workspace details. This example uses placeholders:

{
  "key": "API_KEY",
  "workspace": "form-workspace-id",
  "status": "active",
  "issuedAt": "2021-06-16T13:22:20+00:00"
}

The key field contains the submitted key. Redact it before sharing the response or including it in logs.

API keys

An API key identifies a workspace in Form LMS, not an individual learner.

• Each key is a unique, random string of 40 characters.
• A workspace can have up to two active keys. You cannot create another key while two are active.
• Keys can be active, suspended or expired.
• All keys have the same access level. You cannot assign roles to individual keys.

The key must be recognised and must not be expired or suspended. The API service must be enabled for the customer account and the API enabled for the workspace.

Authentication and authorisation

Authentication checks the API key and identifies its workspace. Authorisation determines what the authenticated caller can do.

The Authorization header is the mechanism for supplying the key. Its name does not mean you should send a learner's login credentials or an SSO token.

This guide covers the public Form User API. It does not describe authentication for other Form services or the Form application itself.

Header compatibility

Send only one authentication header. If several are supplied, the first non-empty value wins in this order: Authorization, Authorisation, Authentication.

An invalid higher-priority value does not fall back to another header. Header names are case-insensitive.

The extractor also accepts an exact leading Bearer prefix on any supported header. This is compatibility behaviour: it still expects an API key, not an OAuth or SSO token.

Use the raw key for new integrations. The prefix handling is case-sensitive and does not trim extra whitespace.

Use the API reference

In the API reference, click Authorize, enter the raw key and confirm. Then open an endpoint and click Try it out to prepare a request.

The apiKey security scheme sends the key in the Authorization header. Execute sends the request to the displayed server.

The reference retains entered keys in browser session storage. Use Logout in the Authorize dialogue to clear the saved key.

Troubleshoot authentication

Key validation failures return 401 Unauthorized. Read the response message to identify the cause:

{
  "error": "Authentication error",
  "message": "Unknown API Key"
}

A missing header is also an authentication failure; its response may differ from the key-validation example above. Check that your HTTP client actually sends the header.

If these checks do not resolve the problem, contact Me Learning support. Do not include the API key in your message.

Manage and replace keys

Generate or suspend keys in your workspace's API integration settings. Creating a replacement does not deactivate an existing key.

Update your integration to use the new key, verify it, then suspend the old key. If a key is compromised, suspend it immediately.

For the setup steps, see Getting started.