Kahoot! vs Quizgecko

Kahoot! 69

OAuth 2.0 client credentials with an opaque bearer token from a Keycloak realm; the client id and secret are issued by Kahoot! and the spec defines no scopes (24 of 30). The API is read-only by design and reaches one organisation's data (16 of 20). Open-ended, word-cloud and brainstorming answers are participant-written text with no guidance on handling it (5 of 15). Enterprise admins get user management and reports, but no per-call API log is documented (4 of 15). security.txt with Expires 2027-10-02, a published disclosure policy without rewards, ISO 27001 certification and SOC 2 Type 2 stated (20). 24 + 16 + 5 + 4 + 20 = 69.

Quizgecko 5

One bearer token per account with no scopes, expiry or rotation described, and ?api_key= is documented as a query-string option, so 10 less 10 (0 of 30). No read-only mode or confirmation for edits (0 of 20). The API fetches URLs and uploads the owner supplies and returns generated text; no guidance on treating fetched content as untrusted (3 of 15). GET /usage shows counts only, no per-call log (2 of 15). /.well-known/security.txt returned 404, the security page answered a Cloudflare challenge and no disclosure policy, bounty or certification was found elsewhere (0 of 20, with the security page unchecked). 0 + 0 + 3 + 2 + 0 = 5.

Kahoot! 73

Closed service with clear terms naming Kahoot! AS, Norwegian law and an Acceptable Use Policy dated 22 October 2026 (15 of 30). Privacy notice effective 22 October 2026 with a DPA and a subprocessor list dated 3 March 2025; retention is stated as the relationship plus limitation periods, with 24 months for candidates and six months for backups, and AI vendors may not train on platform data (24 of 30). No deprecation policy or notice period found (0 of 20). Fourteen subprocessors named with countries, AWS, Google Cloud, Aiven, OVH and Hetzner among them, and US or EU hosting on enterprise (18 of 20). 15 + 24 + 0 + 18 = 57.

Quizgecko 35

Closed service. The terms page answered a Cloudflare challenge, so the entity and terms were read only from Companies House and the App Store (8 of 30). The privacy policy is disallowed by robots.txt and the security page is behind the challenge, so retention and data-handling statements are unread (0 of 30). V1 is called legacy and still served, with no date or policy (5 of 20). No subprocessors or data locations found on the readable pages (0 of 20). 8 + 0 + 5 + 0 = 13.

Kahoot! 45

Read with the hosted lines. status.kahoot.com is an Atlassian Statuspage with component history (20). One incident since 5 August 2026, YouTube video disruptions on 22 September, minor, about six hours (20). No rate limits in the OpenAPI file, and the support guide that might hold them answered our reader with a Cloudflare check (0). No 429 or retry guidance (0). No SLA found; the Master Service Agreement on the trust centre wasn't read (0). The spec is version 0.1.0 with no stability statement, though the enterprise page sells the API as a feature (5 of 10). 20 + 20 + 0 + 0 + 0 + 5 = 45.

Quizgecko 20

Read with the hosted lines. No status page found, and status.quizgecko.com has no DNS record; the API catalogue links only a health endpoint that answered {"status":"ok"} (0). No readable incident history (5). No rate limit with numbers; the OpenAPI document lists a 429 and GET /usage reports a monthly course-creation limit, which is a quota, not a rate (5 of 15). No Retry-After, backoff guidance or idempotency keys, and generation is a write that creates a course each time (0). No SLA (0). V2 is the current API and is not marked beta (10). 0 + 5 + 5 + 0 + 0 + 10 = 20.

Kahoot! 66

Eleven compact GET endpoints returning typed JSON (20 of 25). Cursor pagination with limit up to 100 on users, versions and games, and startedSince on games; no field selection (16 of 20). Only 401 and 403 are documented, with no body schema or codes to branch on (6 of 20). Read-only, so every call is safe to retry (16 of 20). One or two path parameters per call and sensible paging defaults, but no official SDK in any language (8 of 15). 20 + 16 + 6 + 16 + 8 = 66.

Quizgecko 45

Six operations with compact responses, a generation-status call that returns progress without the course body, and no field selection (15 of 25). No list endpoints, so no pagination or filtering to speak of (5 of 20). Validation errors are keyed by field and the monthly-limit error carries the limit and usage, but HTTP codes are documented only in the spec (12 of 20). No idempotency key; a retried POST /generate creates another course, and regeneration through quiz_id is the only guard (5 of 20). One source field is enough to generate, options have defaults, but there are no SDKs (8 of 15). 15 + 5 + 12 + 5 + 8 = 45.

Kahoot! 62

Public OpenAPI 3.1.0 at results.kahoot.com/openapi (25). No llms.txt on kahoot.com, 404 on 3 November 2026 (0). Every operation has a one-line description and the schemas describe each answer type, but nothing says when to use an endpoint or what the data window is (12 of 20). Path ids are typed as UUID, limit has a 1 to 100 range and default, 12 enums such as game mode and answer status, and a discriminator on answer type (12 of 15). Twelve example values in the schemas, but responses list only 200, 401 and 403 with no error body (8 of 15). A /v1 prefix and an ApiVersion schema, with no public changelog for the API (5 of 15). 25 + 0 + 12 + 12 + 8 + 5 = 62.

Quizgecko 68

Public OpenAPI 3.1.0 document at /.well-known/openapi-v2.json, linked from an RFC 9727 API catalogue (25). llms.txt on quizgecko.com describes the product, plans and API (10). Every operation has a summary and POST /generate a description; the HTML docs explain the generate, poll, read, edit flow, but there is no when-not-to-use guidance (10 of 20). The spec has no enums, PUT /quizzes takes an object with no defined properties, and the question endpoints and file upload are absent from it; the HTML docs give the difficulty and status enumerations (6 of 15). Request and response examples throughout the HTML docs, five error codes with one envelope, but the usage examples disagree with each other on the monthly limit (10 of 15). V1 and V2 are separate paths with separate docs and V1 is called legacy, but there is no changelog or dated notice (7 of 15). 25 + 10 + 10 + 6 + 10 + 7 = 68.