Lab keys and the practice service

The practice service

The practice service lives at https://labnet.beyondthelogin.com. Anyone can send it requests, with or without an account: send GET / for the list of endpoints. It echoes requests back as JSON, answers with any status code you ask for, follows redirect chains, demonstrates Basic and Bearer authentication with fixed practice credentials, sets cookies, shows caching and CORS headers, and reports the TLS version your connection used. It also answers plain HTTP on port 80, so you can type a request by hand. A plain HTTP request that carries a lab key is refused, and if the key is active, the service revokes it at once.

Whatever you send is treated as untrusted data. The service never runs it, never fetches an address you give it, and returns it only as JSON or plain text with headers that stop a browser from running it.

Lab keys

A lab key looks like btl_lab_ followed by 43 random characters. Create one on your profile's Lab keys tab, give it a name such as the computer you use it on, and copy it: it is shown only once. Send it with each request as Authorization: Bearer $BTL_LAB_KEY.

A lab key records lab progress and keeps your practice notes. Nothing else accepts it: it cannot sign in, change your account, read your Beyond the Login data or reach any tenant. Each key works for 30 days, and you can hold up to 5 active keys. Revoke a key on the same tab when you no longer need it, or at once if it might have been seen by someone else; the steps it already recorded stay recorded. Beyond the Login keeps only a SHA-256 digest of each key, so nobody, including Beyond the Login staff, can show it to you again.

Keeping a key safe

Read the key into a shell variable without it appearing on screen or in your history:

read -rs BTL_LAB_KEY
export BTL_LAB_KEY

Paste the key when the cursor waits, and press Enter. The variable lasts until you close the terminal. Do not paste the key into a web page, a chat or a file you share, and only send it to https:// addresses: a key sent over plain HTTP crosses the network unencrypted, so the service refuses the request and revokes the key at once. Create a new key on your profile if that happens.

How progress is recorded

On a Technical Foundations lab page, press Start, then work through the steps. Each checked step names what the practice service must see, such as a request typed by hand or a note created through its API. When a request with your lab key does exactly that, the service records the step for your account with the time. The lab-activity window beside the steps checks on its own while the page is open and shows every step recorded since you pressed Start; its Check progress button checks at once, and so does the one after the last step. The lab is complete when all of them are. Starting again begins a new attempt; a completed lab stays completed.

The service sees only what you send it. Nothing watches your terminal, reads your files or collects your shell history.

Challenges

Some skills, such as moving around directories or filtering text, happen entirely on your computer. For those, a lab asks you to download a challenge file from /challenges/<name>, work out the answer with the commands the lesson teaches, and send the answer back. Every learner gets a different file, so only the answer from your own file counts. Wrong answers are fine: try again.

Your computer

Lessons and labs show steps for the computer you choose: Ubuntu 24.04 (on Windows through WSL, or installed directly) or macOS 14 or later with Homebrew. The choice is remembered in your browser and, when you are signed in, on your account, so every device shows the same steps. Change it from any lesson with steps for your computer, or on your profile's Lab keys tab. The setup lesson's environment check sends your tool versions to /env-check, which reads only the version numbers and whether dig and nc were found, then tells you if anything is too old or missing.

Limits, Audit and privacy

Your profile's Usage tab shows the limits on your lab keys: keys created per day, active keys, practice requests sent with a key per minute, challenge answers per ten minutes, practice notes, and changes to your computer choice. Revoking a key is never held back by a limit. Each network also has a shared ceiling on practice requests; when you reach it the service answers 429 with Retry-After, which the lessons use to explain rate limits. Practice notes are removed a day after their last change.

Creating and revoking a key, and a refused use of an expired or revoked key, are security events on your account. They appear in your account activity and in your home org's Audit and Logs, and never include the key. The practice service's own logs record the endpoint, the status and your home org when a key identified you, never your headers, bodies, query values or key. The practice service is Beyond the Login's own service for the labs; tenants do not configure it.