---
title: Authentication
description: Quiz Tracker has no authentication. Here is what that means for who can read and change data.
url: https://quiz-tracker.thally.app/api/authentication
---

# Authentication

Quiz Tracker has no authentication. Here is what that means for who can read and change data.

Quiz Tracker has no accounts, API keys or sessions. Every endpoint is open to
anyone who can reach the server.

That is a deliberate scope choice for a self-hosted tool, and it has
consequences you should plan for:

- **Anyone who can reach the URL can create and delete quizzes.** Run it on a
  private network or behind your own access control if that matters.
- **The `studentName` on an attempt is self-reported.** It is a label for the
  history, not an identity.
- **Correct answers are still protected while a quiz is taken.**
  `GET /api/quizzes/:id` never includes `correctAnswer`. Answers are only
  returned in an attempt's results, after grading on the server.

> **The public demo is shared:**
  Because there is no authentication, anything you create on the live demo
  is visible to and deletable by everyone. Use a local instance for testing.