Skip to main content
Documentation

Connect your site

One organization, one Moodle

Every organization owns exactly one Moodle connection. Because the connection is 1:1 with an install, if you run several (production and staging, or several institutions) you need one organization per install: each one gets its own endpoint, its own keys and its own usage.

Register the site

  1. Open Organization → Moodle and enter your Moodle URL. HTTPS is required and the URL is validated against private address ranges, so a site that isn't publicly reachable is rejected here.

  2. The panel generates two credentials and shows them only once:

    • the license key, which identifies your install;
    • the panel secret, used to sign every request between the plugin and the panel.

    Alongside them you'll also see your subdomain and the URL of your MCP endpoint — these two aren't secrets, and you can look them up on this same page again whenever you need to.

  3. Copy the values and paste them into the plugin: see the Moodle plugin.

Holding the license key alone grants nothing: every request must also carry a valid signature computed with the secret, so the pair only works together.

The plugin's Validate license button confirms the credentials and that the URL registered in the panel matches the site that's actually calling. Once verified, the panel caches your site's name, version and language from Moodle's own site-info call, and shows them on the Moodle page.

If the check fails, Troubleshooting covers the usual causes.

Rotate credentials

Organization → Moodle → Rotate credentials immediately invalidates the current license key and secret and issues a new pair, shown once. Every owner and admin of the organization gets a security notification.

Rotate when:

  • the secret may have been exposed (sent by email, committed to a repository, seen by someone who has left);
  • you're migrating the site to a different server or hosting provider;
  • you've lost the values and need a working pair again.

The connection stops working until you paste the new pair into the plugin, so plan for a couple of minutes of downtime for the assistants.

Change the site URL

Changing the URL re-runs the same validation. If your Moodle moves to a new domain, update it here first, then re-validate from the plugin. Keys keep working: they're tied to the connection, not to the hostname.

Disconnect

Disconnecting removes the stored credentials and the encrypted Moodle tokens, and stops the MCP endpoint from resolving. Existing keys stop working immediately. The web-service tokens remain in your Moodle until you remove them there, so also revoke the users in the plugin if you're decommissioning the site.