Changes to the API, SDKs, embeds, and question type platform, in chronological order.
Embed Sessions started out as a way to give teachers Examplary's authoring tools inside your product. There are now two flows for the other side of the classroom:
take-exam — a student sits a test without leaving your platformpractice-space-student — a student works through a practice space at their own paceThey're created the same way as every other flow, with a POST /embed-sessions call and the student's user ID as the actor.
@examplary/sdk has been rebuilt around one method per API operation, with typed inputs and responses throughout:
import { Examplary } from "@examplary/sdk";
const client = new Examplary({ apiKey: process.env.EXAMPLARY_API_KEY });
const exam = await client.exams.create({
name: "End-of-term assessment",
language: "en",
});
Path, query and body parameters go into a single object, and every method takes an optional axios request config as a second argument if you need a timeout or an abort signal. It's generated from the same OpenAPI spec as the reference docs, so it keeps up with the API automatically.
The authorization code flow now supports PKCE, so you can add Sign in with Examplary to a mobile or single-page app without shipping a client secret.
Send a code_challenge and code_challenge_method when you redirect users to authorize, then the matching code_verifier when you exchange the code for tokens. Everything else works exactly as it does today — see the OAuth guide.
You can now build integrations that act on behalf of Examplary users, instead of asking them to paste an API key into your product.
Register an application under Account → Developer → Manage OAuth clients, send users through the authorization code flow, and you get back an access token you can use as a Bearer token on any API request — the same way an API key works today.
Tokens are scoped, so you only ask for the parts of a workspace you actually need, and users see exactly what you asked for on the authorization screen. When someone disconnects your integration, call POST /oauth/revoke to clean up their tokens.
Full walkthrough in the OAuth guide.