||

Authentication

The Brainshark API uses session-based authentication. Before making API calls, you'll need to establish a session to get your sid (Session ID) and sky (Session Key).

What you'll learn:

• How to create public and private sessions
• Working with session credentials
• Using user tickets for SSO integrations
• Generating auto-login tokens

TL;DR

POST to /brainshark/webservices_mobile/session.ashx with your login_dir, username, and password. Use the returned sid and sky in all subsequent requests.

Prerequisites

• Your company's login_dir (site name from your Brainshark URL)
• Valid Brainshark credentials (for private sessions)

Credentials in query strings

The Brainshark API passes session credentials (sid, sky, uid) as URL query parameters. These can appear in server access logs, browser history, and proxy logs. Avoid logging raw request URLs in your application, and rotate sessions frequently to limit exposure.

Session types

Brainshark supports two types of sessions:

Type	Use case
Public	Access publicly available content without credentials
Private	Full access to private content, reports, and admin features

Create a public session

Use a public session to access publicly available content without user credentials.

Endpoint: POST /brainshark/webservices_mobile/session.ashx

Parameters

Parameter	Type	Required	Description
login_dir	string	Yes	Your company's unique site name (e.g., test-company)

Example request

cURL

curl -X POST https://www.brainshark.com/brainshark/webservices_mobile/session.ashx \
  -H "Content-Type: application/json" \
  -d '{"login_dir": "test-company"}'

JavaScript

const response = await fetch('https://www.brainshark.com/brainshark/webservices_mobile/session.ashx', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ login_dir: 'test-company' }),
});

const data = await response.json();
console.log(data);

Python

import requests

url = "https://www.brainshark.com/brainshark/webservices_mobile/session.ashx"
payload = {"login_dir": "test-company"}

response = requests.post(url, json=payload)
print(response.json())

Example response

{
  "Id": 123456789,
  "Key": "a1b2c3d4e5f6g7h8i9j0",
  "UId": 0,
  "FirstName": "",
  "LastName": "",
  "Token": "",
  "isAdmin": false,
  "isAuthor": false
}

For public sessions, FirstName, LastName, and Token will be empty, and UId will be 0.

Create a private session

Use a private session to authenticate a user and access content based on their permissions.

Endpoint: POST /brainshark/webservices_mobile/session.ashx

Parameters

Parameter	Type	Required	Description
login_dir	string	Yes	Your company's site name
username	string	Yes (unless token or ticket used)	The user's Brainshark username
password	string	Yes (unless token or ticket used)	The user's password
token	string	No	A one-time auto-login token from token.ashx. Use in place of username and password.
ticket	string	No	A temporary login ticket from userticket.ashx. Use in place of username and password.

SSO users

If your company uses Single Sign-On (SSO) exclusively, only Company Administrators can create sessions via the API.

Example request

cURL

curl -X POST https://www.brainshark.com/brainshark/webservices_mobile/session.ashx \
  -H "Content-Type: application/json" \
  -d '{
    "login_dir": "test-company",
    "username": "developer_user",
    "password": "secure_password"
  }'

JavaScript

const response = await fetch('https://www.brainshark.com/brainshark/webservices_mobile/session.ashx', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    login_dir: 'test-company',
    username: 'developer_user',
    password: 'secure_password',
  }),
});

const data = await response.json();
const { Id: sid, Key: sky, UId: uid } = data;
// Use sid, sky, uid in subsequent requests — do not log or store insecurely

Python

import requests

url = "https://www.brainshark.com/brainshark/webservices_mobile/session.ashx"
payload = {
    "login_dir": "test-company",
    "username": "developer_user",
    "password": "secure_password"
}

response = requests.post(url, json=payload)
data = response.json()
sid, sky, uid = data["Id"], data["Key"], data["UId"]
# Use sid, sky, uid in subsequent requests — do not log or store insecurely

Response

Field	Type	Description
Id	integer	Session ID (sid) — use this in subsequent requests
Key	string	Session Key (sky) — use this in subsequent requests
UId	integer	The authenticated user's ID
isAdmin	boolean	true if the user has admin privileges
isAuthor	boolean	true if the user can create content

Example response

{
  "Id": 987654321,
  "Key": "x9y8z7w6v5u4t3s2r1q0",
  "UId": 2548390,
  "FirstName": "John",
  "LastName": "Smith",
  "Token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "isAdmin": true,
  "isAuthor": true
}

User tickets

Need to authenticate users through your own system? User tickets let admins generate temporary session tokens for other users — perfect for "Login-and-Go" SSO integrations.

Endpoint: POST /brainshark/webservices_mobile/userticket.ashx

Admin required

Only Company Administrators can generate user tickets.

Parameters

Parameter	Type	Required	Description
sid	string	Yes	Your admin session ID
sky	string	Yes	Your admin session key
uid	integer	Yes	Your admin user ID
userid	integer	Yes	The target user's Brainshark ID
login_dir	string	Yes	Your company's site name

Example request

cURL

curl -X POST https://www.brainshark.com/brainshark/webservices_mobile/userticket.ashx \
  -H "Content-Type: application/json" \
  -d '{
    "sid": "987654321",
    "sky": "x9y8z7w6v5u4t3s2r1q0",
    "uid": 2548390,
    "userid": 1162335,
    "login_dir": "test-company"
  }'

JavaScript

const response = await fetch('https://www.brainshark.com/brainshark/webservices_mobile/userticket.ashx', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    sid: '987654321',
    sky: 'x9y8z7w6v5u4t3s2r1q0',
    uid: 2548390,
    userid: 1162335,
    login_dir: 'test-company',
  }),
});

const data = await response.json();
console.log(data);

Python

import requests

url = "https://www.brainshark.com/brainshark/webservices_mobile/userticket.ashx"
payload = {
    "sid": "987654321",
    "sky": "x9y8z7w6v5u4t3s2r1q0",
    "uid": 2548390,
    "userid": 1162335,
    "login_dir": "test-company"
}

response = requests.post(url, json=payload)
print(response.json())

Example response

{
  "TicketKey": "953f7a5ec4aa48cf977900bccd624626",
  "CompanyId": 1305797
}

Pass the TicketKey to the session.ashx endpoint as the ticket parameter to log in as that user.

Generate an auto-login token

Use this endpoint to generate a one-time token that logs a user in automatically without a password. Pass the returned token as the token parameter in a private session request.

Endpoint: GET /brainshark/webservices_mobile/token.ashx

Admin required

Only Company Administrators can generate tokens for other users.

Parameters

Parameter	Type	Required	Description
sid	string	Yes	Your admin session ID
sky	string	Yes	Your admin session key
uid	integer	Yes	Your admin user ID
login_dir	string	No	The company's unique site directory. Required when generating a token for another user.
username	string	No	Username of the user to create the token for.
email	string	No	Email address of the user. Use instead of username if the username is unknown.
email_token	boolean	No	When true, emails the generated token directly to the user.
url	string	No	URL to redirect the user to after auto-login.

Example request

curl "https://www.brainshark.com/brainshark/webservices_mobile/token.ashx?sid=987654321&sky=x9y8z7w6v5u4t3s2r1q0&uid=2548390&login_dir=test-company&username=jsmith%40example.com"

Example response

{
  "Token": "a4f9e2b1c3d5f7g8h0i2"
}

Next steps

Now that you can authenticate, learn how to manage users or jump straight to retrieving presentations.