Coding assessment API
A coding assessment API whose results anyone can verify
A signed receipt is a statement, signed by OnlineCompiler.io, that code with a given hash was run against tests with a given hash and produced a given verdict and score. Coding assessment and hiring platforms, course sites that issue certificates and schools use it to show that a stored result is the one our run produced and has not been edited since. Every judged submission gets one, unless it failed on our side, on every plan.
By the OnlineCompiler.io team. Updated . We make OnlineCompiler.io, so we're one of the options here. Every competitor figure links to the vendor's own page, and we say where our API falls short.
What a receipt proves
A receipt records the SHA-256 of the code, the salted hashes of the tests and input files, the settings used, the compiler and its container image, the overall verdict and score, and a verdict for each test. Change any of it and the signature no longer verifies. So a receipt shows that this code, against these tests, gave this result on this date.
A receipt does not prove who wrote the code, or that they wrote it without help.
Hidden tests appear in a receipt only as a verdict and a hidden flag. The code, the tests and the printed
output are never in it.
How it works
- Send the code and its tests to
POST /api/run-tests/. The request waits for the verdicts by default. Setasyncand it answers at once with a submission id, and the submission is judged in your account's queue. - With a
callback_url, we post the finished submission to you in a signed webhook, retried if your endpoint does not answer. You can also look the submission up later by its id. - Each finished submission carries a
receipt: ids, the account reference, yourexternal_ref, the time it was issued, the hashes, the settings, the verdicts, thekey_idand the signature. - Check the signature offline against the public key list, which needs no API key. The receipts reference has the fields, the hashing rules and verification code.
- To show a result to someone else, share the submission. That publishes its receipt at a page like
/r/{id}and as JSON, without the code, the tests or the outputs.
Sharing publishes the receipt's external_ref and the account reference too, so use an opaque external_ref, such as an attempt id, and never an email address or a name.
Signed webhooks and signed results compared
Checked against each project's public documentation on 4 November 2026: Sphere Engine's webhook security page, Judge0's documentation (its callbacks) and Piston's README.
| Signed webhooks | Signed results | |
|---|---|---|
| OnlineCompiler.io | Yes, on run-tests, per API key, retried | Yes, an Ed25519 receipt per submission |
| Sphere Engine | Yes, HMAC-SHA256 with a shared secret | None documented |
| Judge0 | No signature documented | None documented |
| Piston | No callbacks | None documented |
Run-code callbacks, which are separate from run-tests, are not signed. Webhooks that carry a shared secret prove who sent a message to whoever holds the secret; a receipt can be checked by anyone with the public key, long after the message arrived.
Try it
Start with the run-tests reference, then the webhooks and receipts pages. The Free plan has 100,000 runs a month, with receipts included.
Frequently asked questions
How long are results and receipts kept?
Submissions are kept for a period set by the plan: Free 90 days, Starter 365 days, Pro 730 days, Business 730 days. Shared receipt links stop working after that. A receipt you saved still verifies, because the check needs only the public key list.
What happens when the signing key is rotated?
New receipts name the new key in key_id. Keys that no longer sign stay in the public list, so older receipts keep verifying. If you meet a key_id you do not have, fetch the list again.
What happens to a receipt when I delete a submission?
DELETE removes the submission, its tests' stored data and any output files, and its receipt stops being public. A copy you saved keeps verifying, since the signature does not depend on our stored data.
What does it cost?
Receipts and signed webhooks are included in every plan, Free too, with no separate charge. Judging uses one run per test, against the plan's monthly runs (100,000 on Free). Async submissions wait in a queue of up to 80 on Free, 200 on Starter, 400 on Pro, 800 on Business.
How do I verify a receipt without your SDK?
Fetch the public key list at https://api.onlinecompiler.io/.well-known/receipt-keys.json, remove signature from the receipt, write the rest as RFC 8785 canonical JSON, and check the Ed25519 signature over those bytes with the key the receipt names in key_id. Any library that does canonical JSON and Ed25519 will do. The receipts docs have complete Python and Node.js programs.
Does a receipt prove who wrote the code?
No. A receipt does not prove who wrote the code, or that they wrote it without help. It proves what ran, against which tests and settings, and what came out.