Authentication

All API requests require authentication via an API key. Your memories are private and completely isolated from other users.

API Keys

API keys are the primary authentication method. Each key is scoped to your account and provides full access to your memories.

Creating a Key

Generate keys from the Dashboard → API Keys page. Keys start with the ctx_ prefix.

Using a Key

Pass your API key in the Authorization header as a Bearer token:

Authorization: Bearer ctx_your_key_here

OAuth 2.0 (Connectors)

For MCP clients that support OAuth-based authentication (like remote MCP connections), Cortex implements the standard OAuth 2.0 authorization code flow with PKCE.

Discovery

The OAuth metadata is available at the standard well-known endpoint:

GET /.well-known/oauth-authorization-server

Endpoints

EndpointDescription
/api/oauth/registerDynamic client registration
/api/oauth/authorizeAuthorization endpoint
/api/oauth/tokenToken exchange endpoint

Security

  • • All API communication occurs over HTTPS
  • • API keys are hashed before storage — they cannot be recovered, only regenerated
  • • Each key is scoped to a single user account
  • • Memories are fully isolated — no cross-user access is possible
  • • Keys can be revoked instantly from the dashboard

Error Responses

Authentication failures return standard HTTP error codes:

CodeMeaning
401 UnauthorizedMissing or invalid API key
403 ForbiddenKey is valid but lacks permission for this resource