Authorization

The Cognis Public API uses API key authentication. Every request must include a valid API key in the Authorization header. The gateway validates the key, loads the associated user and organization, and enforces scopes per endpoint.

Creating API keys

Go to Account → Developer in the Cognis app to create API keys. Keys have the prefix cogn_. Each key is tied to your user account and an organization. Store keys securely and never expose them in client-side code or public repositories.

Using the key

Include the key in every request using the Bearer scheme:

Authorization: Bearer cogn_xxxxxxxxxxxx

Scopes

API keys are scoped to organization members. The member must have API access allowed in their org settings. Each endpoint declares required scopes (e.g. org:webhooks:read). The key must have at least those scopes. See each endpoint's documentation for required scopes.

Org-scoped endpoints

Most endpoints are org-scoped (e.g. /org/:orgId/...). The orgId in the path must match an organization the key's user belongs to. Use the org ID from the app (prefix org_).