From the student portal to the exam in one click

When a student presses Start, the portal's backend makes one signed call to the Kreedens API and gets back a single-use exam link. The student goes straight in, and the grade comes back to the portal on its own.

Try the live demo See the API operations

Northbridge portal

Your system. Enrols students, starts exams, records results.

Start examSigned request: start exam

Exam linkSingle-use exam link

ResultGrading result (webhook)

Pulse Exams

On the Kreedens API. Issues the link, runs and grades the exam.

How it works, start to finish

Step 1
The registrar enrols students
The portal creates candidate accounts and enrols them in an exam with API calls. Kreedens reports when a batch is done.
Step 2
The student presses Start
The portal's backend makes one signed request to start the exam for that student, and gets back an exam link.
Step 3
The link opens the exam once
The student is sent straight in. The link works one time, on the device that opens it; a forwarded link is refused.
Step 4
The result comes back
When the exam is graded, Kreedens calls the portal with the result. The portal checks the signature before recording it.

What keeps it safe

No student passwords pass between the two systems, and nothing in a link or a webhook can be forged or reused.

Signed requests: Every call from the portal carries an HMAC signature made with its API secret, so Kreedens knows who sent it and that nothing changed on the way.
Single-use, device-bound links: An exam link is redeemed once and tied to the device that redeems it. Sharing it with someone else gets them nowhere.
Verified webhooks: Results arrive as webhooks. The portal recomputes the signature over the exact bytes it received and ignores anything that doesn't match.

The API operations

Everything the demo portal does maps to one of these. Exact paths, headers and field names come from the Kreedens API reference.

OperationThe portal sendsIt gets back

List exams: Sends: Nothing; Gets back: Published exams, and whether each needs individual enrolment
Create candidate: Sends: First and last name; Gets back: The new candidate's account
Enrol candidates: Sends: Exam and candidate emails; Gets back: Confirmation; a webhook when the batch finishes
Find a candidate's exams: Sends: Candidate email; Gets back: The exams they can sit
Start exam: Sends: Candidate email and exam; Gets back: A single-use redirect_url for the student
Webhooks to the portal: Sends: (sent by Kreedens); Gets back: Exam graded; batch enrolment finished

Checking a webhook

This is how the demo portal checks every result it receives at its webhook address:

https://mockportal-zeta.vercel.app/api/webhooks/kreedens

It reads the x-kreedens-signature header. The header name and signature format are set in this portal's config, so they can match the Kreedens reference exactly.

import { createHmac, timingSafeEqual } from "node:crypto";

// rawBody: the request body exactly as received, before JSON parsing.
export function isGenuine(rawBody, signatureHeader, secret) {
  const expected = Buffer.from(createHmac("sha256", secret).update(rawBody).digest("hex"));
  // Hex HMAC-SHA256 of the raw body; a "sha256=" prefix is tolerated.
  const received = Buffer.from((signatureHeader ?? "").trim().replace(/^sha256=/, ""));
  return expected.length === received.length && timingSafeEqual(expected, received);
}

See it end to end

Enrol a student as the admin, start the exam as the student, and watch the result arrive.

Open the demo campus

From the student portal to the exam in one click

How it works, start to finish

The registrar enrols students

The student presses Start

The link opens the exam once

The result comes back

What keeps it safe

The API operations

Checking a webhook

See it end to end

Checking a webhook