Tutor LMS v4.2.0 is Released with Secure REST API Authentication, Faster Performance, and More

Today we’re releasing Tutor LMS v4.2.0, focused on making the REST API more secure, faster, and reliable.

At the heart of this update is a redesigned authentication flow with personalized access tokens and proper role-aware authorization. We’ve also improved loading performance in key areas of the platform. This is the most significant REST API update in Tutor LMS history.

Alongside these security improvements, we’ve optimized course list loading in the WordPress admin area and improved the Analytics data export process. The release also includes a range of fixes and refinements across the platform.

Here’s a closer look at what’s new and what you need to know before updating.

Tutor LMS v4.2.0 at a glance

• Personalized access tokens and refresh tokens for secure REST API authentication
• Endpoint-level authorization based on user roles and capabilities
• Enforced API key permissions across all REST API routes
• Stronger protection for course content and quiz answers
• Faster course list loading in the admin and optimized Analytics exports
• Multiple reliability and security fixes throughout the platform

To get the full changelog, check the Tutor LMS v4.2.0 release notes.

Secure REST API Authentication

The biggest change in Tutor LMS v4.2.0 is the redesigned REST API authentication system. Previously, applications used Basic Auth with an API key and secret on every request. That authentication method is no longer supported from version 4.2.0.

The new system separates application permissions from user identity. API credentials identify the application and define its permission level, while an access token identifies the end user making the request. This allows Tutor LMS to check both the application’s permissions and the user’s access rights before returning data or performing an operation.

Here is the new flow:

1. Generate an API key: Choose a permission level: Read, Write, Delete, or All.
2. Authenticate once: Send the key and secret along with the end user’s credentials.
3. Receive two tokens: You get an access token and a refresh token.
4. Use the access token: Send it with every request that follows.

When the access token expires, the refresh token renews it. No new login needed.

For implementation details and endpoint requirements, please check the Tutor LMS REST API documentation.

Tutor LMS Access and Refresh token lifetimes are configurable in days. By default, access tokens last 1 day and refresh tokens last 30 days. If needed, you can update the token lifetime validity from WP Admin > Tutor LMS > Tools > REST API. 

Alongside the new token system, we’ve strengthened authorization across the board. For example:

• Every REST API request now follows proper role and capability checks.
• Sensitive learning content (including lessons, topics, announcements, and quiz answers) requires valid enrollment or appropriate instructor/admin permissions.
• API key permissions are strictly enforced on all routes.

These changes make it significantly safer to build mobile apps, custom dashboards, headless frontends, and third-party integrations with Tutor LMS.

Important Notice for eLearning Site Owners

After updating to Tutor LMS v4.2.0, you must update the payment gateway plugin(s) too.

This helps maintain compatibility and keeps your checkout working as expected. Check the latest version of each payment gateway you use and update it accordingly.

Latest Payment Gateway Versions

• Stripe: v1.0.10
• Alipay: v1.0.1
• Mollie: v1.1.0
• Klarna: v1.0.2
• Paddle: v1.0.5
• Razorpay: v1.1.1
• Paystack: v1.0.2
• 2Checkout: v1.0.2
• Authorize.Net: v1.0.6

Update the payment gateway plugins you use on your site to their respective versions listed above.

Performance Improvements

Alongside the REST API updates, Tutor LMS v4.2.0 includes performance improvements in multiple key areas. Such as:

• Faster Course List Loading

We’ve optimized the course list page in the WordPress admin area to improve loading performance. This makes course management more responsive for administrators working with their eLearning platforms.

• Optimized Analytics Data Exports

Tutor LMS Pro also includes improvements to Analytics data exports. The export process has been optimized to improve performance when generating reports and working with analytics data.

Additional Improvements and Fixes

Tutor LMS v4.2.0 also includes a wide range of bug fixes and refinements across the platform. These address reported issues in areas such as quizzes, assignments, subscriptions, checkout, mobile navigation, and more.

All of these updates complement the new security controls and performance improvements, making the release a valuable update for both site owners and developers.

Migration Note for Existing API Integrations

If you already have applications or integrations using the Tutor LMS REST API, please note the following:

• Basic Auth using the API key and secret for the previous request flow is no longer supported.
• Existing integrations must adopt the new token-based authentication process.
• Applications should use access tokens for authenticated requests and refresh tokens to renew sessions.
• We strongly recommend reviewing your integrations and thoroughly testing the updated authentication flow before deploying to production.

For full implementation details, please check the Tutor LMS REST API documentation.

Update to Tutor LMS v4.2.0

Tutor LMS v4.2.0 brings a major step forward in REST API security with personalized access tokens, enforced API permissions, and stronger authorization checks. Combined with faster course list loading, optimized Analytics exports, and numerous fixes, this release helps developers build integrations with greater control over API access.

Update to Tutor LMS 4.2.0 to get the latest improvements. If you maintain an existing REST API integration, review the new authentication flow and test your implementation before deploying it to production.